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RECOMMENDATIONS FOR THE NEXT GENERATION 
RANGE SAFETY SYSTEM (RSS) 
INTEGRATED RECEIVER/DECODER (IRD) 


1.0 INTRODUCTION 

The Integrated Receiver/Decoder currently used 
on the Space Shuttle was designed in the 1980 
and prior time frame. Over the past 12 years, 
several parts have become obsolete or difficult to 
obtain. As directed by Marshall Space Flight 
Center, a primary objective of this study is to 
investigate updating the IRD design using latest 
technology components. Also, the study is to 
consider further integration of the various range 
safety subsystems. 

To take advantage of experience with the current 
design, this report includes (in Sections 2.0 and 
3.0) an analysis of failures and a review of dis- 
crepancy reports, material review board actions, 
scrap, etc. 

As a result of the study, a recommended new 
design designated as the Advanced 
Receiver/Decoder (ARD) is presented in Section 
4.0. This design uses latest technology compo- 
nents to simplify circuits, improve performance, 
reduce size and cost, and improve reliability. A 
Self-Test command is recommended that can 
improve and simplify operational procedures. In 
Section 5.0, the new design is contrasted with the 
old. 

Possible simplification of the total Range Safety 
System is discussed in Section 6.0. Included are 
some operational aspects as well as integrating 
various system functions and the IRD into a 
single housing. With this approach, a total 
system weight savings of 76 pounds is 
anticipated. This version of the Re- 
ceiver/Decoder is designated the Enhanced 
Receiver/Decoder (ERD). 


Ordinance systems are discussed in Section 8.0, 
elimination of outstanding system waivers is dis- 
cussed in Section 9.0, and conclusions are 
presented in section 10.0. 


2.0 ANALYSIS OF FAILURES AND 
TRENDS 

A review of failure related documentation for the 
history of the IRD has been conducted and is dis- 
cussed in subsequent paragraphs. The 
documentation includes the following: 

• Test Discrepancy Reports (TDRs) 

• Material Review Board Reports (MRB) 

• Material Review Reports (MRR) 

• Scrap and In-Process Failure information. 

The above items have been reviewed from past 
IRD programs which are summarized in Table 1 . 


2.1 Test Discrepancy Reports Review 

All of the IRD test discrepancy reports (TDR's) 
were examined and those that were Test Set or 
operator related put aside. Those remaining, 
which were actual IRD failures, are listed in 
Table 2. A total of only 20 failures from Feb. 
1982 through Oct. 1991 have occurred during 
acceptance testing as shown in the table. No 
trend has been identified, although 6 failures were 
related to various alignment problems. 
Elimination of some or all of the variable compo- 
nents will prevent failures of this type. 


In Section 7.0, a single-step crypto technique is 
presented that can improve and simplify opera- 
tional procedures. 


1 


j J ^ CINCINNATI g 
/ J-J IL1CTBQNICS 9 


Next Generation IRD Study 


Table 1. IRD Programs Reviewed 


P.O. No. 



Effort 


Desi 


Build 18 units 


Build 10 units 


Recertify 55 units 


Re 


Build 62 units 


Table 2. Summary of IRD Acceptance Test Failures 



Room 



Room 


TDR No. 


4144-33 


4144-34 


4144-48 


4144-51 


4144-53 


4144-54 


4144-58 


4144-61 


4433-01 


4433-02 


4433-04 


Hot/Cold | 4520-01 


4520-02 




4516-14 


4516-17 


Trend 4516-18 




03/22/82 


03/30/82 


09/22/82 


05/18/82 


10/15/82 


12/10/82 


4144-55 | 12/23/82 


07/21/83 


12/08/83 


12/27/84 


10/23/85 


06/13/86 


01/19/89 


10/23/89 


11/30/89 


01/04/90 


01/23/90 


4516-20 02/28/90 


4513-01 05/23/90 


4538-04 07/19/91 


4.9.1 


4.9. 1.4 


4.9. 1.6 


4.9. 1.2 


4.9. 1.4 


4.9. 1.4 


4.9. 1.4 


4.9.1 


4.9.1. 6 


4.9. 1.4 


4.9. 1.3 


120 4.9.1. 3 


Cause/Corrective Action 


Adjust C4. 


Faulty ground connection at C5 in preselector. 



J3 wire shorted to case. 


Defective Clock Osc. 


Poor ground at C9 on Decoder Interface. 


Defective feed-thru Capacitor C2. 


Defective feed-thru Capacitor C2. 


Incorrectly aligned discriminator. 


Broken transformer lead. 


Refurbishment/realignment. 


lacement Decoder interface. 


Replace C4. 


Reselect A3 R14 Receiver Assembl' 


Realignment of Receiver. 




Realignment of Receiver. 


36 1 4. 9. 2. 4. 8 | Broken wire crystal filter. 


Power Supply diodes CR12/CR13. 


Retainer bars left out. 


Capacitor on Command Output (<4). 


R15 Decoder Interface reselected. 



Z2? 


CINCINNATI | 
IL1CTRC3NIC1 I 


























































































































Next Generation IRD Study 


2.2 Material Review Board (MRB) 

Review 

All available Material Review Board (MRB) 
records were examined for trends, causes and 
corrective action. Available records reviewed 
were for programs 4412, 4426, and 4538. For 
programs 4412 and 4426, all nonconformances 
were dispositioned through the Material Review 
Board. For program 4538, standard repair 
authority was granted which allowed exposed 
weaves and measles to be dispositioned 
internally, without govemment/USBI signature. 
4538 standard repair data is contained in section 

2.3 of this report. 

Figure 1 is a summary of all the MRBs for these 
projects. 81% are attributed to Lifted Pads, 
Exposed weaves, and Measles. 


2.2.1 Lifted Pads 

Lifted Pad problems are mostly attributed to the 
Command Output, Power Supply, and Converter 
Printed Wiring Assemblies (PWAs) (P/Ns 
635147, 635144, and 635168 respectively). 
Causes include: 

• Board material design (Epoxy Glass). 

• Dense population of parts. 

• "V" swaged terminal design. 

• Excessive connector rework, on the 635147 
PWAs, due to the connector configuration 
changes and potting. 

• Q1 and Q2 Transistors being mounted too 
high on the 635168 PWA causing excessive 
rework. 

• Operators applying excessive heat, pressure 
and/or dwell time during soldering. 

Although the operators are cautioned for causing 
lifted pads, investigation has revealed that the 
design attributes to most of the occurrences. 
Choice of board materials will greatly reduce, if 
not totally eliminate, lifted pads. Materials such 
as Polyimide, versus the existing Epoxy Glass, 


have been procured and are presently being fabri- 
cated and tested. Polyimide can handle initial 
soldering and rework much better than epoxy 
glass. Design Engineering is also looking into 
less population of components on the PWAs by 
using more chip versus leaded parts. Terminals, 
if used at all, will be role swage configuration 
connected to adjacent through-hole circuit paths 
versus the present "V" swage type installed on 
solder pads. The "V" swaged terminals stress the 
solder pads and, when soldered, create lifts. 
Alternate flex print to PC board connection tech- 
niques are being considered by Engineering. 


2.2.2 Exposed Weave and Measles 

Most of the exposed weave and measle problems 
are caused by the same reasons previously men- 
tioned under lifted pads. Data evaluation shows 
these discrepancies random throughout all 
assemblies. Two step soldering also attributes to 
these problems where double-ended terminals are 
high temp, soldered (sn40/sn96) and then wires 
are attached with low temp, solder (sn62/sn63). 

The corrective actions to reduce/eliminate these 
problems are also the same as mentioned under 
lifted pads. Use of polyimide board materials will 
greatly reduce lifted pads, exposed weaves and 
measles. Polyimide in combination with elimi- 
nating terminals on solder pads, Z wires, and 
decreasing the number of components will reduce 
MRB type nonconformances by approximately 
81%. For the most recent program, 4538, MRBs 
related to these defects total 58 out of 67, 86.5%. 
The above corrections in the new design will not 
only reduce MRBs significantly, but they will 
also reduce rework and increase the reliability of 
our product. 


2.3 Material Review Report (MRR) 
Examination 

The only available MRR data reviewed was on 
program 4538. As mentioned in para. 2.2, MRR 
(standard repair) data for earlier programs are a 
part of the MRB data. Figure 2 summarizes the 
MRRs processed on 4538 totalling 233. 180 or 
77.25% were processed for measles, and 53 or 
22.75% were for exposed weave. 
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PROGRAMS 4412, 4426, & 4538 MRB DISTRIBUTION 
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Figure 1. MRB Summary 
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Figure 2 . Project 4538 MRR Summary 
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Exposed weaves are random throughout all of the 
PWAs. Measles, however, occur more on PWAs 
which have numerous terminals and "Z" wires. 
Most of the measling is related to two PWAs, the 
Decoder assembly (P/N~635174) and the I/O 
assembly (P/N 635150). The decoder has double 
ended terminals spaced close to one another 
swaged to epoxy glass boards. The swaging 
weakens the PWB at the installation hole. When 
soldered, measles (minor surface delaminations) 
extend between the terminals. On the I/O assem- 
bly there are "Z" wires installed close to circuit 
traces which are soldered to both sides of the 
board. The "Z" wires were oxidizing before 
installation creating excessive soldering tempera- 
tures and dwell times along with rework. Due to 
higher temperatures and longer dwell times, 
measles occurred. In noticing this problem new 
"Z" wires were procured which decreased the 
measling some, but did not totally eliminate the 
problem. 

Although most of the measles have occurred on 
the above assemblies, measles along with 
exposed weaves are random on all other assem- 
blies also. The general causes are the same as 
mentioned in the MRB Section, 2.2.2. The 
corrective actions from a design standpoint are 
also the same. Although the measles and exposed 
weaves are repaired by applying epoxy over the 
areas, this process is costly and can be easily 
reduced if not eliminated. Again, our plans to use 
polyimide board materials on future designs will 
contribute highly in eliminating these kinds of 
repairs. 


2.4 Scrap and In-Process Test Failure 
Review 

For this section, multiple data bases and record 
files were reviewed to identify any scrap and/or 
in-process/confidence test failure trends. Data 
reviewed and analyzed were for programs 4144, 
4412, 4426, 4433, 4513, 4534, and 4538. 


2.4.1 Program 414414412 

The data for these programs show no trends or 
concerns in scrap or in-process testing. 


2.4.2 Program 4426 

The data for this program shows various ITS-M 
(M38510) ICs rejected for body and seal cracks. 
Part numbers include; ITS-M- 11563, 64, 66, 67, 
68, 69, 72, and ITS-M- 11946, 50, 52, 54-56, 
58-62, 64 and 65. 

Failure analyses were performed at CE and USBI 
(Ref CE FR # 736-23086). The cause was 
determined to be improper handling. These ICs 
were being solder dip tinned and then immediately 
dipped into alcohol. Operators were not allowing 
the ICs to cool down before cleaning. Thermal 
stress created cracks in the IC bodies and glass 
seals. After analyzing the severity of the cracks a 
decision to scrap the parts was made. Preventive 
action included educating the operators, 
procedural changes, and instituting visual 
inspection points after tinning for damage. No 
further trends of this type have occurred. 

The only other trend on this program is in relation 
to delamination of flex prints, P/Ns 393005-1,2, 
and 3. This problem is due to general rework. 
When rework is performed which requires 
removal of the flex prints, the flex prints are 
normally replaced. The flex prints presently on 
this program cannot handle multiple reworks. 
Engineering is looking into alternate interconnect 
methods and/or more durable flex prints for future 
designs. 


2.4.3 Program 4433/4534 (Salt Water 

Refurbishment) 

The data analyzed for these programs reveal the 
same trends. The scrap data base shows trends in 
removal/replacement of washers, screws, connec- 
tors, gaskets and flex prints. This result is 
expected since these parts are automatically 
replaced per the salt water refurbishment require- 
ments. The only engineering improvements in 
this area were to change from cadmium plated 
washers to stainless steal washers. This change 
would be carried over to the new design if 
washers arc used. There are no in-process test or 
other further trends. 
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2.4.4 Program 4513 

The data for this program shows a few trends. 
During the May and June time frame of 1989, 
several microcircuits, P/N TTS-M-12612, were 
failing during in-process testing on the Wait State 
boards, assembly no. 392306, for excess propa- 
gation delay and fall times. The part propagation 
times were within the military specification limit 
for the part but were too slow for worst case 
circuit conditions. Previously parts purchased 
from a different manufacturer had acceptable 
delays. The corrective action was to replace this 
part with a faster mechanically equivalent device. 

Another trend noticed was on all RCR type 
resistors for carbon separation. During tinning 
and in-process rework, the carbon in the resistors 
was pulling away from the lead end seals caused 
by thermal stress. Corrective action was 
implementation of tinning tool gages to assure no 
solder wicking up into the resistor end seals. 
Although this decreased the problem, it did not 
totally eliminate it. This problem has also showed 
up throughout the 4538 production build. The 
real fix will be instituted in the new design by 
utilizing chip parts in lieu of these old style 
resistors. 

The next trend evaluated is inherent in the design 
and will probably remain in future designs. 
Several RCR type resistors were scrapped due to 
the re-selection process during tuning. This trend 
is normal but will decrease as variable 
components are deleted from the new design. 

Another trend noticed was on RTH42ES type 
resistors for illegible marking. Several of these 
type resistors were scrapped due to marking 
coming off during assembly. These resistors are 
glass packaged components. During handling 
and normal in-process cleaning they have a 
tendency to lose their marking. Corrective action 
was to coat these parts with a protective epoxy to 
preserve the marking. This corrective action has 
decreased these occurrences but not totally 
eliminated them. Use of these parts will 
occasionally show scrap trends due to their glass 
construction. 

The final trend noticed on this program was on 
foil shields, P/N 392337 and 392339, which are 


attached to the power supply for tuning purposes. 
Several of these shields were scrapped due to 
retuning or not placed/positioned properly. These 
foil shields have a sticky back tape and when 
installed wrong, or removed for tuning, are 
automatically scrapped. The future design will 
utilize proper ground planes to eliminate the use 
of this material. 

No further trends in scrap and/or in- 
process/confidence testing were found. 


2.4.5 Program 4538 

The first trend noticed on this project was the high 
scrap rates of washers, P/N MS27 183-5. These 
washers were scrapped for the same reasons 
explained under the salt water programs 4433 and 
4534. These washers were changed to stainless 
steel per change notice A348 1 . 

Another trend noticed is also the same as 
previously mentioned under the 4513 project on 
the RCR type resistors with carbon separation. 
The causes and corrective actions are the same. 
Eliminating this type of part from the design is the 
only sure fix. One thing noticed, however, is the 
tuning process must have been significantly 
enhanced from 4513 to 4538. Not nearly as 
many RCR type resistors or foil shields were 
replaced due to tuning and alignment problems. 

Several problems were uncovered in relation to 
the board edge connectors, P/N 392349 (various 
dash numbers). An excessive amount of these 
parts were replaced due to the potting meniscus 
coming too far down obscuring solder fillets. 
Then several were scrapped in trying to pick this 
potting out for assembly build. Many corrections 
were implemented from design changes to special 
inspection instructions, but the only true fix is to 
design or procure different style connectors. 
These connectors have been eliminated in the 
recommended design. 

Another trend noticed was the same as on 4426 in 
relation to flex print replacements. These two 
programs built the most quantities of units and 
this trend is expected for the same reasons as 
mentioned under 4426. 


6 


CINCINNATI B 
*LlCTBONIC« B 


Next Generation IRD Study 


Another major trend noticed is in relation to the 
amount of Field Effect Transistors (FETs, P/N 
635080) replaced/scrapped during in-process 
tuning and alignment. Most of these parts were 
replaced due to their gain being too low. Many 
attempts to screen/test these parts at incoming 
inspection prior to use have been implemented, 
but the end result is simply having to screen these 
parts for unit performance during the tuning pro- 
cess. It should be noted that these parts meet their 
individual part specification but go through a 
complex screening effort to meet the unit perfor- 
mance specifications. The only true fix is to 
eliminate these parts which has been done on the 
new design. 

The final trend noticed is in the scrapping of 
several Transistors, P/N 635116, of the same date 
code 8728. These parts were scrapped as 
undesirable date code due to high emitter/base 
capacitance that causes inefficient switching. 
Investigation reveals that these parts met their 
specifications but were damaged during screen- 
ing. The immediate corrective action was to re- 
purchase these parts. The preventive action is 
being addressed in the new design by eliminating 
this part 

No further trends in scrap and/or in-pro- 
cess/confidence testing were found. 


2.5 Force Field Analysis Brainstorming 
Session 

This section of the report has been added to sum- 
marize all the good and undesirable points of the 
existing IRD design. In the last month of the 
4538 program, we assembled some of the key 
operators, test technicians, and inspectors which 
were directly involved in the build, testing, and 
inspection of these units. We utilized a Total 
Quality Management technique called Force Field 
Analysis to brainstorm the good and undesirable 
points of the design. Figure 3 shows the results 
of this analysis. TTte force field represents the top 
8 undesirable points of the design, pushing down 
against the equilibrium point, along with the top 8 
good points of the design, pushing up against the 
equilibrium point, (the equilibrium point repre- 
sents the best design possible). Although these 
16 points were prioritized, all the data is being 
evaluated for design improvements. 


GOOD DESIGN 

1 . Automatic Test Equipment. 

2. Open Case Troubleshooting (ease to get to 
test points). 

3. Use of Double- sided PWBs Vs. Multilayer. 

4. Stud Connections Vs. Clinched, Stitch 
wires Vs. Z wires. 

5 . Concept of Flex-print design. 

6. Wide range of Tunability. 

7. All boards easy to inspect, except Power 
Supply. 

8 . Plated through holes. 

9. Chassis Design, Good Fit and Size. 


UNDESIRABLE DESIGN 

1. Not enough real estate, too many parts, 
need more use of surface mount parts vs. 
leaded parts. 

2. Soldering to the chassis vs. terminals or 
PWBs, poor plating on the chassis. 

3. NASA Solder spec., too vague, open to 
multiple interpretations. 

4. Undesirable components: 

• Matched sets 

• Ball Brazed Diodes (Unitrode), height 
problems 

• Part marking Durability, Permanency 

• Capton Insulators 

• Carbon Resistors 

• Field Effect Transistors (FETs) 

• Feed-thru Filters, end seals melt and 
crack 

• Rubber Bumpers on Decoder Interface 

• Hybrid Clock (CPU Assy), hard to 
mount/replace 

• Feed-thru terminals, swage type 

• Filter Brackets, FL1 and FL2 
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5. Undesirable wiring: 

• Point-to-point wiring 

• Use of solid wire (Filter Wires) 

• Having to perform pinch wire testing 

• Use of rigid/brittle wire types 

• Use of same colored wires for multiple 
conn. 

6. Too many subassemblies 

7. Use of Glass Epoxy PWBs Vs. Polyimide. 
Use of Polyimide will reduce measling 
exposed weaves and lifted pads. 

8. Undesirable Potting/Conformal Coating 
(CC): 

• Potting of Digital Modules 

• Potting in the Edge Board Connectors 

• RTVing the Decoder Assy solder con- 
nections 

• Long Cure Times 

• Use of Urethane CC Vs. solvent soluble 
CC 

9. Flex-Prints not durable enough. 

10. No processor emulation capabilities. 

1 1 . Build of blind assemblies. 

12. External paint, requires touch-up and added 
labor. 

13. Step soldering, use of high temperature 
solder (SN 40). 

14. TP Height requirements. 

15. Hole in IF board is too small. 

16. Not enough step level drawings (SMC Vs. 
Leaded). 

17. Need more isolation of thermal, ground, 
and/or power planes from Plated Through 
Holes (PTH), reduction in the number 
and/or size of spokes. 


3.0 STATE-OF-THE-ART COMPONENT 
ANALYSIS 

The IRD was designed approximately 12 years 
ago. Since that time, some of the electrical com- 
ponents used have become obsolete and are no 
longer available. Others are still available but do 
not have the advantages offered by newer state- 
of-the-art devices. The electrical components 
used in the IRD have been reviewed and those 
that should be replaced identified and discused in 
the subsequent paragraphs. 

3.1 RF/IF Circuits 

A review of the Receiver circuits shows that the 
use of improved state-of-the-art devices can pro- 
vide design simplicity, improved performance, 
and size reduction. The new components being 
considered are briefly discussed below. 

3.1.1 Surface Acoustic Wave (SAW) 

Filters 

SAW Filters can be used to replace the present 
cavity tuned circuits used in the receiver RF 
section. The excellent out-of-band rejection of 
these devices provides superior frequency selec- 
tivity in the RF signal path and will prevent 
undesired signals from reaching the mixer. 
Figure 4 shows plots of the SAW filter response. 
The three dB bandwidth is 800 kHz compared to 
3 MHz for the current cavity tuned elements. 

The major advantage provided by the use of SAW 
filters is the reduction of RF tuning. The tuning 
elements are inside the package and require no 
adjustment after sealing. The manufacturer speci- 
fies the VSWR to be less than 2.0:1 as shown in 
Figure 4. Trimming to less than 1.5:1 at the 
antenna can be accomplished by a shunt capacitor 
and series inductor at the SAW input. Trimming 
is discussed further in paragraph 4.1.1. 

The SAW filter uses resonator technology which 
results in a low loss design. Figure 4 indicates 
less than 2.5 dB measured loss. The device 
specification requires less than 4.5 dB insertion 
loss. 
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3.1.2 Monolithic Microwave Integrated 
Circuit (MMIC) 

CE recommends the use of a MMIC for the RF 
amplifier. The MMIC amplifier, a MSA0670 
from Avantek, replaces two gain stages. The total 
number of parts in the RF circuit, including the 
SAW filters and lightning protection, is the same. 

This device provides over 18 dB gain at 416.5 
MHz and has a noise figure less than 3 dB. The 
MMIC is a broadband device with input and out- 
put impedances close to 50 ohms. No tuning is 
required. 


3.1.3 SA604A FM Demodulator Inte- 
grated Circuit 

The Signetics SA604 is recommended as a 
replacement for the presently used CA3089 
device. Recent CE designs use the Signetics part. 
Both parts will work well in the IRD application. 
The only significant difference between these two 
parts is power consumption. The CA3089 uses 
about 25 mA for biasing. The SA604 uses 
2.7 mA maximum. Both will use the 10 volt line 
for power. Therefore using the SA604 reduces 
power consumption by about 0.22 watts. 


3.1.4 Active Anti-Alias Filter 

The IRD presently uses an LC filter for alias fre- 
quency rejection. This filter must be carefully 
tuned and requires matched component sets for 
best results. Eight pans are necessary to build the 
filter. 

An active filter with superior response character- 
istics has been developed to replace the passive 
filter. Figure 5 is a plot of its frequency response 
and Figure 6 is a schematic. The filter requires no 
tuning and uses 0.1% resistors and 1% capacitors 
assuring flat passband response and low tempera- 
ture and component drift. Passband ripple is 0.5 
dB maximum. The pilot tone response is 2 dB 
below the response at 10.5 kHz, worst case. 
This response is in contrast with the LC filter pilot 
tone requirement of up to 5 dB below the 
response at 10.5 kHz. 


The filter is comprised of thirty five parts. All, 
except for the operational amplifier, are surface 
mount parts. Although more parts are used, this 
approach provides the following advantages: 

• Significant reduction of construction time 
due to the use of surface mount compo- 
nents. 

• The need for alignment is eliminated 
because the characteristic is controlled by 
the tolerance and variation of the component 
resistors and capacitors. Resulting changes 
are sufficiently small that the characteristic 
remains within the required limits. 

• The need for matched components is elimi- 
nated. 

• Failure rate is improved due to the elimi- 
nation of inductors even though the parts 
count is higher. 

3.2 Decoder Circuits 


3.2.1 Obsolete Components 

Identified in this section are the IRD components 
that are now obsolete and no longer available. 
These devices must be replaced in the new 
design. 


3.2. 1.1 PIN 394820, SBP9989 Microprocessor 

This device is the microprocessor on which the 
IRD design is based. The original design used its 
predecessor, the SBP9900 that became obsolete 
during the first 5 years of usage. The design was 
then modified to use the SBP9989 which was 
nearly equivalent. The SBP9989 is now no 
longer available. This family of processors was 
one of the first if not the first 16-bit micropro- 
cessor available capable of providing the digital 
signal processing required for the IRD design. 

Two possible devices were considered as 
replacements for the SBP9989 microprocessor. 
The first is the TMS320C25. This device is a 
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Figure 6. Anti- Alias Filter Schematic Diagram 
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microprocessor designed specifically for digital 
signal processing. It uses the Harvard 
Architecture (separate Program and Data Busses) 
which permits rapid instruction execution. Most 
instructions can be executed in two machine 
cycles. 

The second device considered was the 
87C196KC microcontroller manufactured by Intel 
Inc. This device has an architecture similar to the 
SBP9989 and has instruction execution times 
faster than the SBP9989 but slower than the 
TMS320C25. The advantage of the 87C196KC 
is the large number of on chip peripherals pro- 
vided. Use of this device would greatly reduce 
the space required for implementing the present 
IRD functions providing room in the IRD package 
for additional functions. This controller is 
presently being used in the design of a Micro 
Secure Range Safety Decoder being developed for 
an IRAD project at Cincinnati Electronics. 


3.2. 1.2 PIN 635066, ER2051 EAROM 

This device, once manufactured by General 
Instruments (now Microchip), is an Electrically 
Alterable Read Only Memory (EAROM) used for 
volatile storage of commands. The ER205 1 was 
selected to replace an equivalent device, the 
NC7051, manufactured by Nitron that became 
obsolete earlier in the Shuttle program. The 
devices have the following disadvantages: 

• The need for two power supply voltages 

• Extremely long access times (10.8 p.s for 
read and 177 ms for write). 

These devices can be replaced by Electrically 
Erasable Programmable Read Only Memories 
(EEPROM) that operate on a single supply volt- 
age (+5 Vdc) and have access times in the 90 to 
100 nanosecond range. The proposed replace- 
ment is the Atmel AT28HC256 (SMD #5962- 
863403) device. This is a (32K x 8) EEPROM 
device available in the following packages: 28 pin 
Ceramic DIP, 28 pin PGA, and 32 pin LCC. The 
(32K x 8) configuration is actually larger than the 
size required by the IRD. A device with a smaller 
configuration (8K x 8) is available but comes in 
the same package sizes. Selection of the larger 


configuration is practical because generally the 
smaller configuration devices are the first to be 
discontinued. 


3.2. 1.3 PIN ITS-C- 11965 , 91L24 RAM 

This device, which is no longer available is a 
(1024 x 4) configuration Random Access 
Memory (RAM) used for working memory and 
data storage for the IRD. These were the only 
suitable M38510 memory devices available at the 
time of the IRD design. State-of-the-art devices 
presently available offer advantages over the 
presently used devices that include: 

• CMOS technology with lower power con- 
sumption 

• More desirable configurations with 8 and 16 
bit widths and higher memory density. 

The RAM device being considered is the 
IDT71256 (SMD# 5962-88552 pending). This is 
a (32K x 8) CMOS RAM manufactured by 
Integrated Device Technology (IDT). This con- 
figuration is larger than that required by the IRD 
but is the physically smallest military part avail- 
able. 


3.2.2 Components to be Replaced by 
State-oMhe-Art Components 

The present IRD decoder contains some compo- 
nents that are not obsolete in terms of availability 
but should be replaced because improved state-of- 
the-art devices can be used to improve perfor- 
mance, reliability, reduce size, power 
consumption, and cost. These devices are dis- 
cussed below. 


3.2.2. 1 PIN 635065, TDC1014 B7A A/D 

Converter 

This device is a 6-bit Flash A/D Converter used 
for sampling the receiver audio. The device dis- 
advantages are: the need for two supply voltages 
and relatively high power consumption (1680 
mW max) which is reduced by pulsing supply 
voltage to it. This approach reduces the power 
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consumption but adds complexity to the IRD cir- 
cuitry. 

A possible replacement for this device is the 
AD7825 8-bit Half Flash Converter. It has the 
following advantages over its predecessor: 

• A built-in 4 input multiplexer 

• Operation with a single +5 Vdc supply 

• Relative low power consumption (80 mW 
typical) 

This converter is recommended if the micro- 
processor selected does not contain an on-chip 
converter. 

3 . 2 . 2 . 2 Series 4000 CMOS and Series 54LS 

Logic 

Peripheral circuits in the IRD design were imple- 
mented with devices from two families of logic 
devices. In areas where speed was not critical the 
series 4000 CMOS devices were used to keep the 
decoder power dissipation low. Most of these 
devices are presently available but can be replaced 
with better devices. The same is true for the 
54LS series TTL devices that were used where 
faster logic speeds were required. 

Logic devices of the 4000 and 54LS series can 
now be replaced with Field Programmable Logic 
Devices. In recent decoder designs (the CRD-1 17 
and CRD- 11 8) CE has used Electrically 
Programmable Logic Devices (EPLD) for periph- 
eral logic. These devices permit user 
configuration of Large Scale Integration (LSI) 
logic elements. Present devices are fabricated 
with CMOS technology and provide speeds 
equivalent to that of Low Power Shottky (LS) 
devices. 


3.3 Power Supply Circuits 

Power supplies continue to shrink as time goes 
on. Since the design of the IRD, integrated 


circuits made specifically for power supplies have 
been developed. New magnetics and new shapes 
allow increased power output per cubic inch. 
Power supply companies now make modules of 
small size that can be used in receivers such as the 
ARD. This section will explore new designs 
developed during some of CE's programs and 
will also investigate the use of supplies produced 
by other vendors. 

The power supply in the IRD is a discrete design 
which uses over 150 pans. Some special circuits 
uniquely designed for the requirements of the pre- 
sent IRD are no longer needed. The supply now 
has nine separate output voltages, a voltage regu- 
lator, and a DC to DC converter. The supply 
envisioned for the ARD has a single DC to DC 
converter and six output voltages. Figure 7 is a 
schematic diagram of the supply. This supply 
features a pulse width modulator IC operating at a 
fixed frequency. The fixed frequency provides 
improved control over spurious responses. A 
snap circuit is included for undervoltage turn off 
and an input filter to assure compliance with MDL- 
STD-461, CE01 and CE03. The supply also has 
reverse voltage protection provided by diode D1 . 

Table 3 compares the present and recommended 
design power supplies. Supply size is signifi- 
candy reduced in the recommended design. The 
number of parts required is reduced to about 55. 
Board area decreases from 39 square inches to 
5.9 square inches. The number of select compo- 
nents is reduced from fourteen to two. 


Table 3. Present Power Supply Vs. 
Recommended Design 


Parameter 

Present Design 

Recommended 

Design 

Size 

39 sq. inches 

5.9 sq. inches 

Power 

Consumption 

15 watts max. 

4 watts max. 

No. of Parts 

152 | 

55 

No. of Selects 

14 

2 
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Figure 7. Power Converter Schematic Diagram 
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CE has requested quotations from various 
vendors for a power supply that meets the power 
requirements of the ARD. The following voltages 
which are standard vendor supply voltages were 
requested: 

• +28 volts at 175 mA, isolated from other 
supplies 

• +5 volts at 310 mA 

• +12 volts at 10 mA 

• -12 volts at 10 mA 

• +12 volts at 75 mA, isolated from other 
supplies 

Compliance with MIL-STD-461, CE01 and CE03 
was a requirement for the quoted supplies. 
Vendors were permitted to quote standard mod- 
ules or a single custom module. When using 
standard modules, the minimum board area 
required is approximately 9. 1 square inches. 

A discrete version, designed by CE requires less 
than 5.9 square inches. Therefore, from a size 
viewpoint, the discrete version is the best choice. 
This choice also provides the advantage of more 
control over the operation and design of the 
supply. 


4.0 RECOMMENDED NEW DESIGN 
APPROACH 

The recommended IRD is designated the 
Advanced Receiver/Decoder (ARD). The associ- 
ated design provides an updated unit with the 
same technical characteristics as the current IRD 
but with added operating capabilities. Only com- 
mand receiving/decoding and decoder related 
functions are discussed in subordinate sections of 
this paragraph. The implementation of Distributor 
functions is provided in the Enhanced Receiver 
Decoder (ERD) which is discussed in paragraph 
6 . 0 . 


4.1 Receiver Circuits 

The present IRD RF portion utilizes four assem- 
blies to achieve RF/analog signal processing. The 
associated interconnection requires 22 wires. CE 
recommends placing all RF/analog functions on 
one circuit card with a resulting improvement in 
reliability and producibility. 

A design similar to that used in current CE 
receivers is recommended. Essentially all RF 
circuitry will be new. Figures 8 and 9 show the 
present and recommended designs respectively. 
SAW filters replace the present LC filters. A 
MMIC is used for the RF amplifier to provide 
design simplicity. The mixer is now double 
balanced. CE recommends a new IF frequency of 
21.4 MHz. This frequency, used in many of our 
present receivers, provides the advantage of 
improved image rejection and smaller crystal 
filters that mount on the circuit board. A S A604A 
Amplifier/Discriminator replaces the CA3089. 
The SA604A draws significantly less power. The 
AGC circuitry is simplified since the 
microprocessor in the decoder corrects for 
temperature changes to provide a linear, precision 
SSTLM output. Finally, the anti-alias filter is 
active, eliminating tuning. Overall, the quantity 
of parts in the receiver section is similar. The 
emphasis in this design is a shift away from 
tuning elements and inductors and towards fixed 
resistors and capacitors. The following 
paragraphs describe each new circuit or 
component in detail. 


4.1.1 RF Preselector - SAWs and MMIC 

Surface acoustic wave filters are used for RF 
filtering in the CRD- 117, CRD- 11 8, CRD- 119, 
and the IRAD Mini Secure Receiver/Decoders 
currently made by Cincinnati Electronics. SAW 
filters provide excellent rejection to the image and 
half IF signals keeping them out of the mixer 
input. 
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Figure 8 . Present IRD Receiver Section 
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4.1.4 Oscillator and Mixer 

The recommended design uses a double balanced 
mixer for improved inter-modulation distortion 
and spurious signal rejection. This mixer requires 
a +7 dBm drive level. As ah example of spurious 
rejection, the mixer reduces the half IF more than 
60 dB with the specified signal levels. Thus the 
mixer is capable of rejecting the half IF without 
the use of filtering. The mixer also attenuates 
local oscillator leakage to the RF port by 25 dB. 

The oscillator presently used in the IRD can be 
used with the double balanced mixer if buffered to 
provide the proper signal level. This approach is 
used in the CRD- 1 18 receiver. One drawback to 
this approach is the multiple tuning adjustments 
required. A packaged oscillator manufactured by 
Vectron which requires no tuning is presently 
being investigated for an IRAD project. 
Screening to class S of MIL-O-553 10 is available. 
Figure 1 1 is a plot of the frequency output of ten 


oscillators over temperature. CE's requested 
variation is ± 30 parts per million or ± 13.1 kHz 
variation maximum. The actual parts remain 
within 20 ppm or 9 kHz. 

The IRD has severe vibration and shock 
requirements. The shock and vibration 
requirements for the oscillator as supplied do not 
address the levels needed by the IRD. Testing 
must be performed to determine the oscillator's 
ability to withstand the higher levels. CE is 
presently performing these tests at its facility. 
Four units were tested for pyrotechnic shock and 
two units were vibration tested. Performance was 
checked before and after the shock test, and 
during the vibration tests. The units successfully 
passed all tests. CE sent two shocked units to 
Vectron to check for any damage that may have 
occurred which is undetectable by CE. 
Discussions arc under way with Vectron to 
incorporate the shock and vibration requirements 
into the oscillator specification. 



Figure 11. Oscillator Temperature Characteristic 
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The crystal inside the oscillator uses a three point 
mount. CE has asked Vectron to consider a four 
point mount to increase the ruggedness of the 
part. 

As indicated above, outstanding issues must be 
resolved before this part can be used in a final 
product. Also, Vectron is the only source for this 
oscillator at the present time. Another vendor has 
indicated a willingness to develop an equivalent 
oscillator but has none at this time. Therefore, 
CE recommends the use of a discrete oscillator 
and buffer stage until such time that these issues 
are resolved. 


4.1.5 Anti-Alias Filter 

An active filter has been developed to replace the 
previous passive filter. This filter has superior 
response characteristics. Figure 5 is a plot of the 
filter frequency response and Figure 6 is a 
schematic. 

The active filter requires 35 components in 
contrast to the 8 required by its predecessor. 
Most of the new filter parts are relatively small 


surface mount components that do not greatly 
increase the overall filter size. Any size increase 
is outweighed by the advantages realized which 
include reduced construction and elimination of 
alignment. Even with the higher component 
count, failure rate of the active filter is improved 
due to the elimination of inductors. Tables 4a and 
4b, summarize the reliability of the two designs. 
The active anti-alias filter failure rate is at least six 
times better than the LC filter. 


4.1.6 Surface Mount Parts 

Recent CE receiver designs employ surface mount 
techniques to attach parts to the circuit boards. 
The majority of the surface mount parts are resis- 
tors and capacitors. These parts also comprise the 
majority of all parts used. Surface mount compo- 
nents reduce significantly the total assembly time 
of a circuit board. Parts are temporarily attached 
to the board and soldered with a single vapor 
phase operation. This process reduces damage to 
the boards by minimizing hand soldering. 
Surface mount parts also reduce the volume 
needed by circuitry which results in reduced 
receiver size. 


Table 4a. LC Anti-Alias Filter Failure Rate 


Component 

Usage 

Failure Rate 
x (10- 6 ) 

Coils, transformers 

4 

0.3187 

Capacitors - CCR78CG822JR 

4 

0.00278 

Total 


0.3215 


Table 4b. Active Anti-Alias Filter Failure Rate 


Component 

Usage 

Failure Rate 
x (10- 6 ) 

Capacitors - using CDR type 

12 

0.00648 

Resistors - using RLR type 

22 

0.01881 

IC-M385 10/1 1906 

1 

0.0245 

Total 


0.04979 
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4.2 Decoder Circuits 


4.2.1 Operation , General 

Figure 12 is a block diagram of the ARD. The 
audio signal from the Receiver is digitized to 8 
bits and stored into a revolving Random- 
Access-Memory (RAM) buffer. Here these 
samples are available for processing to extract a 
transmitted command or pilot tone. 

A microprocessor Central Processing Unit (CPU) 
executes program instructions stored in Erasable- 
Programmable-Read-Only-Memory (EPROM) to 
control data processing algorithms, input/output 
operations. Code Insertion, Telemetry Outputs, or 
Self-Test. 

After reception, a correctly formatted command is 
compared to stored codes (previously inserted via 
a code insertion device) to determine which 


command was transmitted. If an exact match is 
found, the appropriate command is output. The 
commands provided are the secure Arm, Fire, and 
Spare. Also a Test command which causes the 
unit to conduct a Self-Test is provided. 

When the ARD is not processing a command or is 
not in the Code Insertion Mode, it is in a com- 
bination "signal search" and Pilot Tone detection 
mode. Pilot Tone output Telemetry is activated as 
long as a Pilot Tone is transmitted, unless a 
command is received. In this event, the Pilot 
Tone telemetry is turned off and ignored until 
command processing is complete. 

Many separate eleven-character command codes 
can be stored for independent output commands. 
If desired, "null" codes can be stored to prevent 
activation of a command. A KYK-13 electronic 
fill device with appropriate adapters is used to 
load the desired command codes into the ARD. 



Figure 12. Advanced ReceiverlDecoder Block Diagram 
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4.2.2 Decoder Functions 

Listed below are the primary operating functions 
of the Decoder. These and additional functions 
are discussed in more detail in the subsequent 
paragraphs. 

• Digital Signal Processing of Pilot Tone and 
Commands 

• Redundant (Single Point Fail-Safe) 
Command Output Signal Generation 

• Code Insertion Operation 

• Precision Signal Strength Telemetry 

All of the Decoder functions are performed with a 
microprocessor and the following support circuits 
(some circuits are included on the same chip): 

• A/D Converter with Multiplexer 

• Program Memory (EPROM) 

• Data Memory (RAM) 

• Non-Volatile Memory (EEPROM) 

• Input/Output (I/O Circuits) 

• Redundant Command Output Circuits 

4.2.2. 1 Code Insertion 

The code patterns that identify the ARD com- 
mands are stored in EEPROM. These codes are 
loaded using the KYK-13 electronic transfer 
device. The Code Insertion operating mode is 
activated when a KYK-13 device is connected to 
the ARD and turned on. This operation prompts a 
complete Self-Test of the Decoder. A Self-Test 
failure results in a blinking LED Ready Indicator 
on the KYK-13 adaptor, indicating that code 
loading cannot proceed. A successful Self-Test 
results in the Ready Indicator being on continu- 
ously, indicating that code loading may proceed. 

A validity test is made on each message loaded 
from the KYK-13 to the Decoder. This test 
includes verifying the message cyclic check code 
to guarantee that no transmission errors occurred 
as well as verifying that each character has 2 and 


only 2 tones specified. After the message validity 
has been established it is written to EEPROM. It 
is then read back and reverified. These tests 
insure that command codes are correctly stored in 
EEPROM. 

Invalid code received from the KYK-13 results in 
a blinking Ready Indicator on the fill device 
adaptor, indicating to the operator that the code 
was not accepted. 

Null codes can be loaded for any of the com- 
mands to prevent the ARD from generating the 
corresponding command. 

Code insertion Mode of operation is also used to 
load Precision Signal Strength Telemetry coeffi- 
cient parameters into the EEPROM for use by the 
Precision Telemetry algorithm. 

4.2.2.2 Precision Signal Strength Telemetry 

The Precision Signal Strength Telemetry provides 
an ultra accurate signal strength indication without 
the necessity of precise receiver alignment. 
Receiver signal strength output is characterized 
over the operating temperature range and correc- 
tion data stored in a look-up table in available 
non-volatile memory (EEPROM). 
Characterization and determination of correction 
data is done automatically using the decoder test 
set. 

Table 5 illustrates a sample look-up table. 

The rows of the table contain the receiver AGC 
voltages and the columns contain the corre- 
sponding output voltage for 8 temperatures in the 
operating temperature range. During operation, 
the system microprocessor takes a running 
average of the AGC Voltage via the Multiplexer 
and A/D Converter. The same is done for the 
temperature. Averaging is used to eliminate 
errors due to noise. The resulting average AGC 
voltage and temperature values are used to retrieve 
two values from the table which are straight line 
interpolated to obtain the correct output voltage. 
This value is then applied to a D/A convener to 
provide the required Precision Telemetry output. 
Look-up interpolation is done to provide the best 
possible accuracy. 


25 


j J -J CINCINNATI g 
/ ,,7 / SLSCTRONICfl B 


Table 5. Precision Telemetry Look-Up Table Example 


AGC 

READING 


0 

1 

2 

254 

255 


TEMPERATURE READING 


yj 

.5 

—n 

•5 1 

•5 J 

.5 

.5 

.5 

.5 

.576 

PH 


E££l 

.551 

.551 

,5 


■r»i 

W3.1X 

TIM 

■aaa 

■rata 


.631 




m 

pn 


■ms 



4.75 



EKES 

4.75 

iia 



4.75 ' 

4.75 

■ 

■ 


m 

■ 

ISeSI 


4.2.2.3 Self-Test 

Due to higher memory density and larger address 
capacity of the system microprocessor the ARD is 
capable of performing more Self-Tests than its 
predecessor. Self-Test can be initiated three 
different ways: reception of a high alphabet Test 
Command, power-up of the unit, and entry into 
code insertion mode. 

A discussion of the tests to be performed follows: 

• FPROM Test . This test is provided to 
verify that the program memory is operating 
properly and that the contents are correct A 
checksum is calculated on program memory 
contents and compared to a value stored at 
the uppermost location. 

• RAM Test . This test verifies that data 
memory is operating properly. A sliding 
"zero" pattern is written to each location, 
read back and checked. The same is done 
with a sliding "one" pattern and an all "zero" 
pattern. 

• Watchdog Timer Test . This test verifies that 
the Watchdog Timer is operating with the 
proper time-out interval. 

• F FPROM Test . This test verifies that the 
EEPROM is operating and that the Precision 
Signal Strength Ttelemetry coefficients are 
correct. A checksum is calculated on the 
telemetry coefficient data and compared to a 
value stored in the EEPROM. 


• Redundancy Test . This test verifies that all 
Command Outputs are operating in a 
single-component fail-safe mode. 

• Dm Sample Test . This test verifies that 
receiver data is being sampled by the A/D 
converter and that these samples are being 
properly stored in a RAM data buffer. It is 
performed by writing invalid data into 
selected buffer locations and initiating sam- 
ple operation. Later the selected locations 
are examined for valid data which will 
overwrite the previous data if sample opera- 
tion is normal. 

• Command Latch Test . Arm, Fire, and 
Spare Command Latches are monitored for 
the off condition. 

• Command Latch Status Test. This test 
verifies that the Arm, Fire, and Spare 
Command Latch status bits are correct. In 
the event of a test failure an Insurance Word 
is output and the system reinitialized. 

• Sffqnr.nce Anomaly . Insurance words are 
maintained and updated in an internal 
microprocessor register. The insurance 
words are updated as the software travels 
through the signal processing and command 
verify paths. Command output is not pos- 
sible if the insurance word does not match a 
pre-defined pattern. This restriction pre- 
vents soft errors such as single event upsets 
in RAM or in the program counter which 
could potentially bypass sections of 
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code. If an upset occurs, the insurance 
word will not have the update from the 
bypassed code and will not match the pre- 
defined pattern. This match failure identi- 
fies a Sequence- Anomaly and the 
microprocessor inhibits the command output 
and reinitializes operation. 

• Command Window Test . This test verifies 
that the Command Windows which restrict 
access to the A and B Command Output 
Latches are operating. 

A and B Time Windows are provided to 
limit access to the A and B Command out- 
puts respectively. Each window is a pulse 
that can be generated by microprocessor 
on-chip circuitry. Prior to turning on a 
Command Latch this associated window 
must be opened and the latch I/O instruction 
executed while it is open. The window 
signal is capacitively coupled into the latch 
logic so that in the event of a window signal 
failure in the active state the window will 
not remain open. 


4.2.2.4 Test Telemetry 

For test purposes, three lines are provided for a 3- 
bit Mode word that identifies one of eight oper- 
ating states of the ARD Decoder. The software 
updates this state code during operation. This 
code can be monitored to analyze Decoder opera- 
tion. 


4.2.2.5 Data Dump 

A Data Dump capability is provided which out- 
puts the contents of EPROM, RAM and 
EEPROM data (except sensitive information). 
Dump Data and Clock Test lines are provided for 
the Dump interface. The EPROM data is used for 
Software verification, the EEPROM data provides 
Telemetry Coefficient verification, and the RAM 
data provides the values of performance parame- 
ters that are useful for system troubleshooting. 


4.2.3 Safety Features 

To provide single point fail-safe operation a 
number of safety features are provided. These 
features will prevent an inadvertent command 
output due to a failure of any Decoder component 
including the microprocessor. 

4.2.3. 1 Redundant Command Outputs 

The Command Output Circuits for the recom- 
mended design are essentially the same as those 
used in the present IRD. These circuits include: 

• An Overcurrent Circuit (current link circuit) 

• Three Redundant Output Switches 

Figure 13 illustrates one of the Redundant Output 
Switches with the associated circuitry. 
Redundancy is implemented by requiring two 
separate circuits to be activated before issuing any 
individual command. 

One circuit (Q4 and associated drivers) maintains 
a short circuit at the command output and the 
other (Q5) applies nominal 28 Vdc. Opening the 
short circuit (the 1st half or A command) does not 
cause an output until the 28 V source is applied by 
the 2nd half (or B) command. Applying the 28 V 
source without removing the output short causes 
an overcurrent sensing circuit (that also protects 
against other output shorts) to trip. The trip is 
reset via RC time constants well before another 
command can be issued. 

Command tum-off sequence removes the 28 V 
source first (2nd half or B command) and then 
applies the output short (1st half or A command). 

The 28V supply voltage is also activated by the 
second half command. The A and B output timing 
is controlled by the microprocessor such that for 
command activation the A signal always becomes 
active before the B output. On command tum- 
off, the B signal is deactivated before the A 
signal. This sequence assures that both output 
transistors will not be on simultaneously. 
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4.2.3.2 Command Window 

The A and B inputs for the Command Output 
Circuits are provided by output latches controlled 
by the system microprocessor. The A and B 
latches are contained on separate circuit chips. 
This physical separation precludes the possibility 
of both A and B output becoming active due to a 
single integrated circuit failure. 

Access to both A and B latches is protected by 
means of Command Windows. Each window 
consists of a capacitively coupled pulse that con- 
trols access to the corresponding latch. The latch 
will respond to an I/O execution of the micropro- 
cessor only when the corresponding window is 
open (pulse present). System software is 
designed to pre-program a narrow window 
opening before the selected latch I/O instruction is 
executed. The latch can only be accessed when 
the instruction occurs simultaneously with the 
window. 

Use of the windows prevents the latches from 
being activated in the event that random 
instructions are executed by the microprocessor 
which could be caused by a device failure. 


4.2.3.3 Insurance Words 

Insurance Words are maintained by the decoder 
software during operation. These words contain 
data that includes the Self-Test results and confi- 
dence data. The confidence data is updated as the 
software sequences through the signal processing 
and command verification operations and is 
described under the Sequence Anomaly discus- 
sion in paragraph 4.2.2.3. 

The Insurance Word data can be output via 
downlink telemetry as a means of reporting 
abnormal conditions in the ARD. The insurance 
word output is a digital signal placed on the Pilot 
Tone Telemetry. Non Return to Zero (NRZ) data 
with nominal 100 ms bit period is used to allow 
detection of the data with the ground telemetry 
equipment that samples every 30 ms. 

The insurance word output is used to report 
Self-Test results which provide information con- 
cerning the status of the decoder. The 
reco mme nded Insurance Word format is shown in 
Table 6 and the Bit Description in Table 7. 
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Table 6. Insurance Word Output Format 


n i f 

No 

1234 

5678 

111 

9012 

1111 

3456 

1112 

7890 

2222 

1234 

2222 

5678 

2333 

9012 

3333 

3456 

3334 

7890 

T5 •! f 

De f 

PSSI 

IDDD 

DDDD 

DDDD 

DDEE 

ww 

ww 

WW 

WW 

WW 

D -l. 

Bit 

Value 

101X 

xxxx 

XXXX 

XXXX 

XX10 

1010 

1010 

1010 

1010 

101C 


Table 7. Insurance Word Output Bit Description 


Bit 

Symbol 

Bit 

Width 

Description 

p 

100 ms 

Preamble Bit (bit 1) - brackets the word and establishes a level to precede the 
svnc bits , 

s 

150 ms 

Sync Bits (bits 2 & 3) - establishes a pattern that identifies the start of an 
Insurance word 

I 

100 ms 

I.D. Bit (bits 4 & 5) - identify the Insurance Word. Four Insurance Words 
are possible. 

D 

100 ms 

Data Bit (bits 6-18) - provide ARP status data 

E 

100 ms 

End Bit (bits 19 & 20) - provides an end bracket for the data bits and 
establishes a zero level so that the first Visual Bit can be recognized. 

V 

600 ms 

Visual Indicator Bits (bits 21-40) - provide a low frequency square wave 
that can be easily recognized on the Pilot Tone Telemetry recorder chart for 
locating Insurance words. 


The data (D) bits are used to report anomalies in 
Self-Test results or in system operation. The 
actual bit assignments and the number of words 
used will be determined during decoder design. 
Listed in Table 8 are the test results and informa- 
tion to be reported in the insurance words. 

Insurance Words are output only when a 
Self-Test result is negative or the Self-Test 
Command is received. The test is identified by a 
logic ’T" in the corresponding bit location of the 
word. A Complete Self-Test can be initiated three 
ways: 

• Reception of a high alphabet Test Command 

• Power-up of the unit 

• Entry into Code Insertion 


Certain real time tests are under software control 
and are conducted during decoder operation. 
Table 9 shows the conditions under which 
Self-Tests are conducted. Also indicated in the 
table is the system response to test failures. Three 
types of responses are provided when a Self-Test 
is unsuccessful. 

1 . The Type 1 response consists of continuous 
Insurance Word transmission with no 
command processing. This type response is 
provided for failure of a test of circuits or 
components critical to safe operation. The 
decoder software stays in a Self-Test loop 
and no attempt is made to process 
commands to preclude the occurrence of an 
inadvertent output by the defective circuit. 
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Table 8. Information Reported in Insurance Words 


Information Reported 

No. Bits 

Remarks 

EPROM Test Result 

1 

A logic 1 indicates a test failure. 

Internal RAM Test Result 

1 

A logic 1 indicates a test failure. 

External RAM Test Result 

1 

A logic 1 indicates a test failure. 

EEPROM Test Result 

1 

A logic 1 indicates a test failure. 

Watchdog Timer Test Result 

1 

A logic 1 indicates a test failure. 

Command Output Redundancy Test Result 

3 

1 bit for each output: Arm, Fire, and Spare. 

Command Window Test Result 

1 

A logic 1 indicates a test failure. 

Data Sample Test Result 

1 

A logic 1 indicates a test failure. 

Command Latch Test Result 

3 

1 bit for each latch: Arm, Fire, and Spare. 

Seauence Anomaly m 

TBD 

To be determined in the software design. 


Table 9. Self Test Response 


Test 

Pwr 

up 

Code 

Ins 

Test 

Cmd 

Real 

Tune 

PROM 

1 

3 

1 

— 

RAM (INT 7 EXT) 

1 

3 

1* 

— 

EEPROM 

2 

— 

2 


WATCHDOG TIMER 

1 

3 

1* 

2 

REDUNDANCY CMD OUTPUT 

2 

3 

2 

- 

CMD WINDOW 

2 

3 

2 

-- 

DATA SAMPLE 

1 

3 

1* 

— 

COMMAND LATCH 

1 

3 

1* 

1 

COMMAND LATCH STATUS 

— 

— 

— 

2 

SEQUENCE ANOMALY 

— 

— 

— 

2 


1 . Continuous Insurance Words, no command processing. 

2 . Single Insurance Word - continuous command processing. 

3. Continuous error indication on the KYK-13. 

* Test is not performed if a command is active. 
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2. Type 2 response consists of a single 
Insurance Word transmission without inter- 
ruption of command processing. This type 
of response is provided to report the failure 
of a test of a circuit-that does not adversely 
affect command decoding. The EEPROM 
test, for example, indicates that the 
EEPROM is not operating properly or that a 
data error is present in the Telemetry 
Coefficients. If the latter is the case the 
decoder is still capable of properly decoding 
commands. The failure is reported but 
normal operation is allowed to continue. 

3. The Type 3 response is provided when the 
electronic fill device is connected to the 
ARD. At this time Insurance Words are not 
transmitted. Self-Test Failures are flagged 
by flashing the Verify Indicator on the 
KYK-13 Adaptor. Continuous indication is 
provided to insure that the operator will be 
aware that a problem exists in the ARD. 

The EEPROM Test is not conducted during 
Code Insertion because this mode is used to 
load the Telemetry Coefficients that are 
checked by this test. 

The Command Latch Status and Sequence 
Anomaly Tests are not conducted during 
Code Insertion because these tests are an 
integral part of the command processing 
software which is not used at this time. 


4.2.3.4 Command Latch Monitoring 

The command latch outputs are monitored for 
activity. Should either half of a command be set 
high (A or B channel), the level will be detected 
by the system and corrected if possible. If the 
level was caused by a hard component failure and 
cannot be corrected, the second half of the com- 
mand (B if the A channel fails) will prohibit the 
command from being issued. Selected output 
ports of both the 87C196KC and the PSD302 
have a monitor read output capability. 


4.2. 3. 5 Redundancy Check 

The requirement that no single point failure can 
cause an output command is normally solved by 
providing redundant outputs, both of which must 
work for command execution. However, a single 
point failure could cause one of the redundant 
outputs to fail, and system operation would 
appear normal. To assure single point failure 
protection exists just prior to launch, a simple 
redundancy verification method is needed. 

By incorporating redundancy verification in a 
Self-Test routine, this characteristic in addition to 
many other Self-Test parameters can be monitored 
by command as desired. An unclassified Test 
Command can be established that causes the ARD 
to perform Self-Test. Results of the test are 
reported via an Insurance Word. This command 
can be disabled (nulled) when the secure tones are 
loaded if desired. 

Redundancy verification for the ARD design is 
implemented by a circuit that monitors the voltage 
at a key command output test point for each com- 
mand. The proposed microprocessor contains an 
eight channel multiplexer at the A/D convener 
input. This feature allows normal monitoring of 
the receiver output for command uplink 
information as well as monitoring SSTLM, 
temperature, one point in each of the three 
command output circuits and two spares. 

Redesign of the Command Output circuits will 
allow Self-Test redundancy verification. Figure 
14a & 14b is a partial command output schematic 
contrasting the present IRD design (A) with the 
ARD design (B). In the new design, voltage at 
the “RedVer” point is monitored during Self-Test 
by multiplexing through the A/D converter to the 
microprocessor where it is included in the overall 
Self-Test results. 

During Self-Test, the RedVer test points are mea- 
sured before and after applying 5 Vdc through a 
47 Kohm resistor and diode to each output. If the 
output clamp circuit is inoperative, application 
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Figure 14a. Redundant Output Circuit 
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Figure 14b. Redundant Output Circuit (With Verification) 
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of 5 Vdc will cause the voltage at RedVer to 
exceed the “pass” threshold (but not 2 Vdc) and 
be reported to the operator through the pilot tone 
Self-Test monitor output. A second threshold 
could be set on the low .s.ide to report unusually 
low voltages that would occur if the output load 
was abnormally low. 

Initial analysis of this circuit indicates that no 
undetectable single point failure could occur that 
could cause the ARD to be only one failure away 
from an in advertent output. Also, no single point 
failure can cause more than 2 Vdc at a command 
output during Self-Test. 


4.23.6 Complemented A and B Command Bits 

The same data bit is used to set the Arm A channel 
and the Arm B channel. Obtained from different 
output ports, the bit must be in its complemented 
state to set the Arm B channel. This configuration 
prohibits a hardware failure (where a bus data bit 
is shorted to ground or Vcc) from having the 
potential to set both the A and B command chan- 
nels. The same technique is used for the Fire and 
Spare commands. 


4.2.4 Major Decoder Components 

The Intel 87C196KC Microcontroller and the 
Waferscale PSD302 Programmable System 
Device are the major components recommended 
for implementation of the ARD. Both devices are 
programmable and contain a large number of on- 
chip functions which make possible keeping the 
parts count at a minimum while providing the 
required operation. These features result in an 
approach that improves reliability and decreases 
cost. 

Each of the above circuit components is discussed 
in subsequent paragraphs. Also discussed is the 
recommend ARD configuration with these 
devices. 


4.2.4. 1 Microcontroller 

The 87C196KC is one of a family of micro- 
controllers manufactured by Intel Incorporated. 


Like the SBP9989 used in the present IRD it uses 
register-to-register architecture with no 
accumulator. This new device operates with a 
maximum clock frequency of 16 MHz and can 
execute instructions approximately 3 times as fast 
as the SBP9989. In addition, the 87C196KC has 
a large number of on-chip peripherals, and has 
special operating features that make it suitable for 
use in the ARD. 

On-Chip Peripherals 

Listed below are the on-chip peripherals of inter- 
est with a brief description of each. 

• FF.PROM (16K x 8) . This memory is 
available for program storage. The micro- 
controller performs 16 bit operations but 
uses 8 bit instructions. 

• RAM (488 x 8) . The chip contains a total of 
512 bytes of RAM. 24 bytes are reserved 
for special functions and the remaining 488 
are available for the user. This memory can 
be accessed as words (16 bits) or bytes (8 
bits). 

• W flpphHng Timer . This is a 16-bit pro- 
grammable timer that resets the 
microprocessor on time-out. 

• A/D Converter with 8 Input Multiplexer. 
This converter can be operated in 8 or 10-bit 
mode. An 8-Input analog multiplexer is 
provided at the input. 

• Timer 1 and Timer 2 . Each of these is a 16 
bit programmable timer. Timer 1 can be 
configured to operate the A/D Converter. 

• High Speed Outputs (HSQ). Three High 
Speed Outputs are provided that can be 
operated at specified values of Timer 1 or 
Timer 2. 

• Serial Port . A Serial Port with double 
buffering on transmitter and receiver is 
provided. The port is baud rate pro- 
grammable. 

• I/O Ports . A total of five 8-bit I/O ports are 
provided. Some of these ports share device 
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I/O pins with other functions. As a result 
the number of I/O lines available depends 
upon how the microcontroller chip is 
configured in the system. 

A Standard Military Drawing (SMD) number 
5962-90692 has been assigned to this micro- 
controller and qualification is now in process. 


4.2.4.2 Programmable System Device (PSD302) 

The PSD302 is one of a family of programmable 
devices available from Waferscale Integration, 
Inc. These devices are designed to implement the 
required control and peripheral elements of a 
microcontroller-based system to eliminate the 
need for discrete "glue" logic. The PSD302 pro- 
vides the following features that are required in 
the ARD design: 

• I/O Expansion . A maximum of two 8-bit 
and one 4-bit ports can be implemented. 
The number of I/O lines available depends 
upon how the device is configured in the 
system. 

• EPROM . (16K x 8) bits of EPROM is 
available on the device. Since the 
87C196KC microcontroller contains suffi- 
cient EPROM, this additional memory will 
be unused spare. Future Programmable 
System Devices (manufacturer indicates 
about one year) will have EEPROM in place 
of EPROM. The availability of such 
devices will permit eliminating external 
EEPROM now required for secure code 
storage and Precision Telemetry data 
storage. 

• RAM . (2K x 8) bits of RAM arc available 
on the device to supplement the micro- 
controllers internal memory. 

• Chip Select Control/Address Latches . Chip 
select control or latched address lines can be 
implemented on the device. 

• Programmable Address Decoding . Pro- 
grammable address decoding allows 


mapping of the on-chip memory, I/O, and 
Chip Select. Also provided is the capability 
of adding page inputs to expand the 
microcontroller address space. 

• Reliability . The device is procurable to 
MIL-883. Additional screening would be 
necessary where a higher reliability level is 
required. 


4.2.5 Circuit Configuration 

The recommended Decoder design is shown in 
the block diagram of Figure 15. The system 
consists of the 87C196KC microcontroller, two 
of the PSD302 Programmable System Devices, 
and a small number of peripheral circuits. Each 
of the Decoder circuits is described below. 
Shading of the blocks is provided to identify the 
circuits contained in the 87C196KC and PSD302 
devices. 


4.2.5. 1 CPU 

This is the Central Processor Unit (CPU) which 
is the major component of the 87C196KC micro- 
controller. It generates Address, Data, and 
Control Signals that control operation of the on- 
chip and external peripherals. 


4.2.5.2 EPROM (16Kx8) 

This program memory is provided on the 
87C196KC device. The 16 Kbytes available are 
adequate for the ARD control program. 


4. 2.5. 3 RAM 

Random Access Memory (RAM) is used for data 
storage. The ARD uses 488-bytes that are avail- 
able on the microcontroller chip and an additional 
4K-bytes (2K-bytes contained on each PDS302 
device). 
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4.2. 5.4 Mux and A/D Converter 

Resident on the microcontroller chip is an A/D 
Converter with an 8-input analog multiplexer. 
The converter is capable of 8-bit or 10-bit opera- 
tion. The 8-bit mode is used by the ARD. The 
following signals are used as inputs to the multi- 
plexer 

• The receiver audio signal for signal process- 
ing. 

• The receiver AGC (Signal Strength Signal) 
and temperature data from a sensor for 
Precision Telemetry operation. 

• The redundancy circuit output from each of 
the three output commands. 

The 87C196KC has two operating features that 
make data sampling a DMA-like operation which 
does not require program control. These features 
are the High Speed Outputs (HSO) and the 
Peripheral Transfer Server (PTS). 

Using the HSO feature. Timer 2 can be config- 
ured to trigger the A/D Converter at the required 
33.6 kHz rate. The PTS feature permits the 
automatic loading of A/D Converter samples into 
a circular buffer and maintenance of that buffer. 
These operations are performed transparent to the 
CPU but result in a timing overhead that slightly 
increases the instruction execution time. 


4. 2. 5. 5 Latch & Select Decoding 

The Latch & Select Decoding Circuitry resident 
on the PSD302 chip provides the select signals 
for controlling the on-chip RAM (2K x 8) and the 
external EEPROM. 


4.2.5.6 I/O Circuits 

The Unit I/O signals are obtained from three 
sources. The non-command signals are provided 
by the resident microcontroller VO. The first half 
(A) command signals are provided by a PSD302 
device and the second half (B) command signals 
from a second LPSD302 device. These A and B 
signals operate the Command Output Circuits. 
Access to each command port is controlled by a 
command window signal (WA and WB). 


Each window is a pulse generated by the micro- 
controller on-chip circuitry. Prior to turning a 
Command Latch on, this associated window must 
be opened and the latch VO instruction executed 
while it is open. The window signal is 
capacitively coupled into the latch logic so that in 
the event of a window signal failure in the active 
state the window will not remain open. 

The resident VO of the the 87C196KC is used for 
the following interface signals: 

• Pilot Tone Telemetry - a single output line 

• Test Telemetry Outputs - three output lines 

• Data Dump Interface - two output lines for 
Dump Data and Dump Clock 

• Code Insertion Signals - one input line and 
four output lines for Cl Flag, Cl Reference, 
Cl Verify, CE Data, and Cl Clock respec- 
tively. 

• Precision Telemetry - This signal uses an 
output that is Pulse Width Modulated. The 
signal is routed through a Low Pass Filter 
that provides an analog output. 


4.2.5.7 Command Output Circuits 

The Command Output Circuits are redundant cir- 
cuits implemented with discrete components. The 
circuits are driven by the corresponding A and B 
command latches. The Command Output Circuits 
are discussed in paragraph 4.2.3. 1. 


4.2.5. 8 Power-Up Reset and Snap Circuit 

At power-up or following a power glitch, two 
operations must be performed: 

1 . The microcontroller must be reset to insure 
that the on-chip output port lines are initially 
set to the inactive state and the CPU must be 
reset. 

2. The PSD302 device must be reset to set its 
output port lines to the inactive state. 
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Microcontroller reset is provided by the Reset 
Circuit which is required to provide a reset pulse 
greater than 16 state times. The PSD302 reset is 
provided by the Snap Circuit. This circuit is 
voltage dependent and will provide an output 
whenever the supply voltage falls below 
minimum operating voltage for the device. 


4.3 Packaging Concept 

Figure 16 shows the case design concept 
recommended for the Advanced 
Receiver/Decoder. The case is divided into four 
cavities which house the Receiver, Decoder, 
Power Supply Assemblies, and the I/O 
Connectors. The Receiver and Decoder cavities 
are stacked adjacent to those provided for the 
Power Supply and the I/O Connectors. 
Interconnections between the connectors and the 
assemblies are provided by flexprint strips. 

This layout allows independent access to any of 
the circuit assemblies or the connectors by 
removal of bolts connecting the receiver to the 
decoder/power supply. The two halves can be 
folded out (like opening a clamshell) for testing, 
or separated by unsoldering the flexprint. This 
design allows the new package to have the same 
footprint as the present IRD package. See also 
paragraphs 5.8 and 5.13. 


5 0 COMPARISON OF NEW TO OLD 
DESIGN 

This section highlights the improvements made in 
the new ARD design by comparing it to the 
existing IRD. The subsequent paragraphs 
provide a discussion of the design aspects 
compared. 


5.1 New Operating Features 

The Advanced Receiver/Decoder has some new 
operating features not included in the present 
IRD. These features are listed below: 

• Precision SSTLM 


• Added Self-Tests 

■ Redundancy 

■ EEPROM memory 

■ Command windows 

• First and second-half output command time 
window protection 

• RF High Alphabet Test Command with 
results transmitted over the Pilot Tone TLM 
link 

• One Step Crypto option 


5.1.1 Precision Telemetry and Non- 
Volatile Memory Test 

The new design provides a Precision RF Signal 
Strength Telemetry. This feature provides an 
accurate telemetry output that does not require 
precise receiver alignment. The receiver AGC 
output is corrected with data stored in EEPROM. 
Operation is described in paragraph 4.2. 2.2. 

An EEPROM test is added to the Self-Tests 
performed that calculates a checksum on the 
Precision Telemetry data stored in the device. 
The test verifies that the data is correct and that the 
EEPROM is operating properly. 


5.1.2 Redundancy Test 

A Redundancy Check is provided in the ARD 
design. Previously this could only be partially 
performed during Acceptance or Bench Testing 
when the Automated Test Set was used. This 
feature allows complete verification that the unit is 
single point failure safe. Operation is described in 
paragraph 4.2.3.5. 


5.1.3 Insurance Word Reporting 

Insurance Words are output to report abnormal 
ARD conditions. The data provided includes 
Self-Test results and is output on the Pilot Tone 
Telemetry line. This feature is discussed in 
paragraph 4.2.3. 3. 
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5.1.4 One Step Crypto Option 

This feature is a software change that eliminates 
the need for closed-loop RF checkout with secure 
codes loaded. Operation is described in para- 
graph 7.0. 


5.2 Performance 

Care has been taken to insure that the new design 
does not compromise the performance enjoyed by 
the present IRD. All differences that exist are 

Table 10. Specification Table 


improvements over past performance except 
specification 3.2. 1.1.1 Tuning capability as indi- 
cated in Table 10. If it is necessary to tune the 
ARD to a frequency other than 416.5 MHz, the 
SAW Filters would also have to be changed. 

This table provides a comparison of the existing 
IRD to the recommended design. The compari- 
son is made on a paragraph by paragraph basis 
referenced to IRD specification 10SPC-0132. 
Differences are flagged by a in the right hand 
margin. 


- Existing IRD Vs. New ARD 



3.2.1. 1.7 


3 . 2 . 1 . 1.8 


Receiver RF bandwidth 


Telemetry output 


40 to 70 kHz pk (two tones) 

8 kHz pk or less (two tones) 

A ±45 kHz min. operate BW 
3 dB max. ± kHz response 
variation 

-60 dB outside ± 180 kHz 
specs outside ± 10 MHz 

-80 dB image response 

A 0. 1 to 0.5 Vdc (no RF signal) 
B 0.25 to 0.75 incr. @ -97 dBm 
C Not saturate <® < -53 dBm 
D 4.5 to 5 Vdc <® -53 dBm 
4.5 to 5.25 @ > -53 dBm 
E Zo <10 Kohms 
100 Kohm load 
Compatible with decoder 
2 dB max peak-to- valley 
< 5.5 dB @ 15.45 Vs. 10.5 kHz 
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Table 10. Specification Table - Existing IRD Vs. Nee, ARD - Continued 


Spec Para # 

10SPC-0132 Charact eristic 


3.2. 1.2.3 


3.2. 1.2.5 


3.2. 1.2.6 


3.2. 1.2.7 


Decoder S/N sensitivity 


Decoder spurious re 


Tone detector operational freq. range 


Tone detector false alarm rate 


Radar jamming 


decoder input 



mwmunM 

msmmi 

1 1 HP MM 
ISSEIIS^HH 


3.2.1.2.11.4 


Logic requirements 


Valid commands 


Character input 


rvcnder software requirements 


Failure modes 


rational code verification 


Unused memory locations 
implementation _ 


ROM verification 


3.2.1.2.11.5 I Noise and power transients 




3.2.1.2.12.1 


Infinite loo 


Decoder command outputs 


TT7T 


g|gEI|SBEKgjj|Kj 

tmiml 


Output pulse duration 


Output loading nominal 


Output loading maximum 


Output transients , 


Output circuitry 


■musi 


3.2.1.2.14 


3.2.1.2.15 


Command response time 


Test/telemetry outputs 


Pilot tone 


Specification Requirement 


0.1 rejection rate max @ E/No = 

19 dB 


No response from single tone burst 


Operate ± 50 Hz from Ftone 
Not respond > 300 Hz from Ft _ 


< 6 per minute 


Withstand 2 ms blanking in each 
character . 


1.5 Vrms nom. short circuit proof 


A 3 month min. storage 
B KYK-13 compatible 
C Automatic code verify 
D Inhibited readout of previously 
loaded codes 

E Code insertion verification, 
and error detection 
F Null code capability 


Various 


Various 


Various 


Various 


Single point fail safe 


Inhibit unused/illegal codes 


Filled with JMP or NOP - avoid 
catastrophic effects 


Verification during and after 
manufacture and assembly 


No performance or integrity 
degradation (recover) 


Design free of infinite loops 


5 independent outputs _ 


± 2 Vdc regulation 
± 3 Vdc regulation (max load) 


0 Vdc, +2M for all loads 


45 ± 1 ms 


65K/650 Ohms 


175 ohms worst case 


Single point fail-safe 


2 Vpk, 0.1 ms max. 


Continuous operation into all 
loads including a short circuit 


Current 

IRD 



Various (including short circuit 
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Table 10. Specification Table - Existing IRD Vs. New ARD - Continued 


Spec Para# 
10SPC-0132 

Characteristic 

Specification Requirement 

Current 

IRD 

New 

ARD 

3.2. 1.3 

Input power requirements 

A 24 to 36 Vdc supply 
B 50 Vdc reverse voltage 
protection 
C 15 watts max. 

OK 

OK 

12W 

OK 

OK 

<4W 

3.2.1. 3.1 

Under voltage 

No transients > 2 Vpk/0.1 ms for 
supply voltage < 36 Vdc 

OK 

OK 

3.2. 1.4 

Electromagnetic interference 

Various 

OK 

OK 

3.2.1. 5 

Isolation 

Various 

OK 

OK 

3. 2. 1.6 

Inadvertent shorts due to debris 

Prevented by design 

OK 

OK 

3.2.2. 1 

Size 

IDD 16A03344 

87 in 3 

<60 in^ 

3.2.2.2 

Weight 

< 5.5 lbs. 


= 2.5 lbs 

3.2.3 

thru 

3.7.1 

Various 

Various 

OK 

OK 


5.3 Qualification 

The extensive nature of the changes recommended 
to update the IRD result in a major packaging 
change so that requalification would be necessary. 
However, the new packaging approach envi- 
sioned with the reduced number of parts and 
much smaller size improve the ability of the unit 
to pass EMI as well as environmental testing. 
Software algorithm changes will be much less 
extensive and overall performance will be 
improved. 

These changes improve the capability of the unit 
to pass qualification testing. 

5.4 Reliability 

The relative reliability of the IRD compared to that 
of the ARD based on the unit electrical parts lists 


is presented in this paragraph. MIL-HDBK-217E 
Notice 1 Section 5.2, was used for the reliability 
prediction. 

The results indicate that the ARD is significantly 
more reliable than the present design IRD. The 
number of EEE parts was reduced by 45 percent. 
The failure rate was reduced by 44 percent. 
Improvement in reliability is due to fewer parts 
and fewer high failure rate parts. A data summary 
is provided in Table 1 1 . The reliability prediction 
for the IRD and ARD are provided in Appendix 
A. 

Note: Failure Rates are in failures per million 
hours. Mean Time Between Failures 
(MTBF) is in hours. Environment of use 
is Missile Launch (ML) per MIL-217. 


Table 11. Reliability Prediction Summary 


Design 

Failure Rate 
(Failures/Hrs x 10 6 ) 

MTBF 

(Hours) 

Parts Qty 

IRD 

101.85 

9819 

825 

ARD 

57.43 

17414 

456 
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5.5 Failure Modes and Effects 

The most important requirement of the IRD is that 
no single point failure of software or hardware 
shall cause the generation of a signal on a com- 
mand output line. The key features that provide 
this fail safe operation and software fault tolerance 
are listed below: 

1 . The use of redundant output switches. 

2 . Verification of redundant output switches. 

3 . Output Latch Monitoring. 

4. Command Windows to limit access to 
Output Latches. 

5 . The use of a Watchdog Timer. 

6. The use of Insurance Words checks and 
hardware interrupts on Command Outputs. 

These features are responsible for the units com- 
pliance to the system requirements pertaining to 
operational safety. Features 2, 3, and 4 are new 
features provided in the recommended design. 
Table 12 summarizes the recommended design 
ARD compliance to the safety requirements of 
USBI specification 10SPC-0132. Listed in the 
table are the specification requirements along with 
the design features responsible for compliance 
and the testing provided for the compliance verifi- 
cation. Also identified are any differences 
between the present and recommended designs. 


5.6 Redundancy Verification 

As discussed in paragraph 4. 2. 3. 5, minimal 
redesign of the output circuit eliminates the prob- 
lem of providing checkable failsafe. In addition, 
the new design provides much greater flexibility 
in failsafe checking. Initiated by a transmitted 
command, results of the Self-Test including the 
redundancy test are output in a serial data string 
on the pilot tone output channel. 


5.7 Tuning Methods 

A significant number of parts in the present IRD 
require tuning. The Receiver Assembly has four 
variable capacitors. In addition, the input wire is 
adjusted for input VSWR. Four variable capaci- 
tors and two select thermistors are required on the 
Converter Assembly. The Decoder Interface 
Assembly contains one select resistor. Two 
variable capacitors, one select capacitor, seven 
select resistors, and three select thermistors are 
located on the IF Assembly. The Decoder 
(Command Output) Assembly contains one select 
resistor. 

The recommended design has three modules with 
significantly fewer adjustments. The RF/IF has 
seven adjustable inductors, two select capacitors, 
and 4 select resistors. Most of the tuning in the 
RF/IF concerns tuning the RF path and the oscil- 
lator. The power supply has two select resistors 
and the decoder has no select components. Table 
13 summarizes the adjustable components of both 
designs. 

As can be seen, the recommended design reduces 
the total number of adjustments from 40 to 15. 
Also, the effect of the adjustment is isolated to the 
module on which it is located. This feature makes 
each module interchangeable, eliminating the need 
to retune when replacing a module. 


5.8 Receiver/Decoder Isolation 

Disassembly of the present IRD to separate the 
receiver from the decoder requires unsoldering 30 
flexprint terminals. During this study, the pack- 
aging concept was changed to greatly simplify 
physical isolation of and access to the basic ARD 
modules. 

As a result of the large overall reduction in parts 
count, only three printed circuit boards are needed 
for the ARD. Using a “clamshell” approach as 
shown earlier in Figure 16, New Case Design 
Concept, the Receiver can be separated from the 
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Table 12. Summary of Specification Compliance and Testing 



3.2.1.2.11 (A) 
3.2.1.2.11.5 


3.2.1.2.11 (B) 


3.2.1.2.11 (E) 


3.2.1.2.11 (C) 


_ Description 


Noise and Power 
transient recovery 


Invalid address 
Jump recovery 


Related 

Design Features 


Supply Filters, over and under 
voltage cut-off, Snap Circuits 


Redundant outputs. 
Insurance Word checks. 
Command Window, 
Loop Timer 


Invalid RAM data Redundant outputs. Insurance 
parameter recovery Word checks. Loop Timer 

Invalid code Code insertion message checks 

insertion data 2 tones only, 

recovery every parity 



Testin 


Acceptance Test 
& Bench Test 


Self-Test 



Reset on instruction acquisitions outside Program Memory is provided in the present IRD. 
This feature is not possible with the present microcontroller. The Command Window feature 
along with invalid op code interrupt compensate for this missing features. 

An interrupt on invalid op code is an inherent feature of the 87C198KC. 

The 87C196KC has a reset instruction which is used. The present design used branch 
instructions. 
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Table 13. Tuning Method Comparison 


Assembly 

Select 

Resistors 

Variable 

Capacitors 

Select 

Capacitors 

Select 

Thermistors 

Adjustable 

Inductors 

Present IRD 






Receiver 

0 

4 

0 

0 

1 

Converter 

0 

4 

0 

2 

0 

IF 

7 

2 

1 

3 

0 

AGC & Audio 

0 

0 

0 

0 

0 

Power Supply 

14 

0 

0 

0 

0 

Decoder (Cmd Output) 

1 

0 

0 

0 

0 

Decoder Interface 

1 

0 

0 

0 

0 

TOTAL 

23 

10 

1 

5 

1 

Recommended ARD 






RF/IF 

4 

0 

2 

0 

7 

Decoder 

0 

0 

0 

0 

0 

Power Supply 

2 

0 

0 

0 

0 

TOTAL 

6 

0 

2 

0 

7 


decoder very easily by removing the connecting 
bolts and unsoldering 5 flexprint terminals. 
Access to the decoder/command output and power 
supply boards is immediate and access to the 
receiver board requires only removal of a shield 
cover. 


5.9 RF Signal Strength Telemetry 

In the present IRD, the Signal Strength Telemetry 
characteristic is determined by the receiver thermal 
characteristics and depends on precise receiver 
alignment. The recommended design uses a 
"Precision Signal Strength Telemetry" technique 
in which the system microprocessor transforms 
the inherent receiver thermal characteristics to the 
desired temperature compensated characteristic. 
This approach eliminates the need for precise 
receiver alignment and about 50 components. 

Implementation of the technique is discussed in 
paragraph 4.2. 2.2. 


5.10 EEE Parts 

Estimated electrical parts for the ARD are shown 
in two tables. Standard parts that comply with the 
requirements of MIL-STD-975 or 10REG-0036 
are listed in Table 14 and non-compliant parts are 
listed in Table 15. Based on these estimated lists, 
54 part types out of 257 (approximately 21%) are 
non-standard. The following procedure will be 
established for non standard parts: 

1. During the design phase of the program 
conduct a search of how to find standard 
replacements for the non-standard parts. 

2. Request non-standard parts approval for 
those parts that cannot be replaced. 
Generate Source Control Drawings for these 
parts and screen them to the requirements of 
the current program. 
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Table 14. ARD Standard Parts 



i jmap Ba 

i ri^r>]sng3 



BEES3£SEy 


JANS 1N4 148-1 


JANS1N4148-1 


JANS1N5806 


JANS1N5 


JANS1N5811U 


itSSSEI 

IK SB 


iimjaiataEay 

I riTJinTlHcTtM M 

li^KiiftFinwiRM 


nTaRfinTratfftigi 

M 


ap, chip Tan 22 ur 


Tantalum Cap, 6.8uF 


Tantalum Cap, l.OuF 


Tantalum Cap, 1.5uF 


uF 


ap,Chip 1.0UF 10% 


uF 


uF 


Tantalum Cap, 4.7uF 


Diode 


Diode 


Diode 


Diode 


chottky Diode 


Transistor, PNP 


7 A PNP 


ransistor, NPN 


N Transitor 


ner Diode, 10V 


Diode,Zener 5 V 





10V rating, 5 v 


20V rating ,5 v 


0V rating, 10 v, 5 v 


20V rating, 10 v 



nductor 10.0UH 




M55342H06R1 1B7 


M55342H 


ftS 


esistor,Chip 11.7K 0.1% 


esistor,Chip 11. 8K 0.1% 


esistor,Chip 12. IK 0.1% 


esistor,Chip 12.3K 0.1% 


I KTOtgMi(ia:lW:1«.-t: 

nCTt«Mii.aaw:HM»a 

iB^afflaaiaaai^asaiiaiBmiMM^M 

i.amtMinTarMiimif irBrimnwan^ EiaiM 

I lEtttgM iflSI -ML I ITOCTHTMH j€llf I :B!1 




Resistor, Chip 8.76K .01% 


Resistor, Chip 9.76K 0.1% | Rcvr 



SB 
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Table 14. ARD Standard Parts - Continued 


TYP 


M55342K06R100JS 
M55342K06R100JS 1 1 


M55342K06R100KS 


M55342K06R10J0 


M55342K06R1 1K0S 


M55342K06R150JS 


M55342K06R15K0S 


M55342K06R180JS 


Chip Res, 100L 


lOOmW 


0 5% 




M55342K06R1K00 


p Re 


Resistor, Chip lOOK 5% 


Resistor, Chip 10 5% 


Chip Res, llKOlOOmW 


Resistor,Chip 150 5% 


Resistor,Chip 15K 5% 


Resistor, Chip 180 5% 


Resistor,Chip 180K 5% 


Resistor, chip IK 


Resistor, Chip IK 5% 


PS 


Rcvr 


PS 


Rcvr 


Rcvr 


PS 


Rcvr 


Rcvr 


Rcvr 


Rcvr 




M55342K06R1K50 


M55342K06R200KS 


Resistor, Chip 1.5K 5% 


Chip Res, 200 K£2, lOOmW 




Resistor, chip 20K 


I MUAW ttlTil -Mi) mm I 


Resistor,Chip 20K 5% 


Resistor,Chip 220 5% 


Resistor,Chip 22 5% 


i irc tAtEM XiTil :Wf XftP b 

I ■ 7, fcVfcEM XiT fl 'Ml tttV r«i tmt :rr» 

I WTOTil r ^n M 

■i 

■ K fctttg W rgMIt V ■ 

| '*Tr« 1 :73cTfTTI7X*irffrgPt 

■ iftfctfcgM XlTil 

■ sera Mi ><»v raanigmii :<»mnOn 

■ iflfcrtEM XlTa atfiffl KM » u u\ 

■ :<>:* aa mwm i 3 r m7rx»irtnF^ g%MM K 


Resistor, Chip 3K 5% 


Resistor, Chip 3.3K 5% 


Resistor, Chip 47 5% 


K 5% 


Resistor, Chip 51 5% 


i irc KtEM yra aa ra ■» .1 la 

inatmidMuiMIlli— j—li 


M55342K06R7 50J 


, M55342K06R820J 


Resistor, Chip 6.8K 5% 


Resistor, Chip 750 5% 


ResistonChiD 82 5% 
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Table 14. ARD Standard Parts - Continued 


imaiiauuuaa 



PA 


M55342K06R820JS | Resistor, Chip 820 5% 


M55342K06RXXXXS | Resistor, Chip 


1 

1 

T 

1 

T 

I 

1 

1 

I 


M55342K06RXXXXS | Resistor, Chip SOT 


M55342M05R4L70S 

Cap, chip 4.7M 

NB0H10-6PN 

Connector 

NB0H10-6PW 

Connector 

NB0H12-10PN 

Connector 

NB0H14-15PN 

Connector 



naMBaBHia 


Wirewound Res, 0.47 



Table 15. ARD Non-Standard Parts 



2 63536 


1 635362 


1 635364 


1 635366 


1 635366 


1 1 635368 




Xtal, 15.5904 MHz 





Futer,SAW 


Filter, CRYSTAL 2L4MHZ 


I13L702 MHz CRYSTAL 


T TFM-2, IC, MIXER 


Inductor l.OUH 


Inductor 71 3NH 


MSA 0670, IC, RF AMPL. 


Transformer 


Transformer 


Inductor 


Inductor 


Transformer, CE 


Transformer, CE 


Transformer, CE 


Inductor, CE 


ap 100PF 


13 I CDR0 1 BX 1 02BKU 


1TCDR01 BX222BKU 


itwaannEtHiHwa 


1 | CDR01BX561BKUS 


2 


9 TCDR04BX104AKUR 


DR01 Cap 2200pF 


DR01 Cap 330pF 


DR01 Cap 560pF 


ap. Chip .D56uF 


Cap . 1 uF 



PF 10% 


Dcdr 


Dcdr 
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Table 15. ARD Non-Standard Parts - Continued 


nm 

PaRTND | 

■ iTOTtt a i a 

ismi 

mmm 



i 


Cap 3.9PF 

Rcvr 

N 


i 

CDR12????????S 

Cap 6.8PF 

Rcvr 

N 


2 

CDR12????????S 

Cap 18PF 

Rcvr 

N 


1 

CDR12BP??????S 

Cap, Chip SOT 

Rcvr 

N 


1 

CDR12BP0R5ACUS ] 

Cap,Chip 0.5PF +/-.25PF 

Rcvr 

N 


2 

CDR12BP120AJUS 

Cap,Chip 12PF 5% 

Rcvr 

N 


1 

BiaiaaiHaiaaaa 

Cap, Chip 33PF Wo 1 

Rcvr 

N 


2 

CDR12BP470AFUS 

Cap,Chip 47 PF 1% 

Rcvr 

N 


1 

r« •] im :t ttf :l»7^ sikH 

Cap, Chip 68PF 1% | 

Rcvr 

N 





Capacitor, Chip SOT 

Rcvr 

N 


4 

CDR12BX471AKUS 

Cap,Chip 470PF 10% “ 

Rcvr 

N 


12 


Cap, Chip 2200PF 1% 

Rcvr 

N 


1 

II 1 II ' mill 11 

Isolation Amp 

Dcdr 

N 

S level 

1 

JANTXV1N4110-1 

Diode, Zener 16V 

Dcdr 

N 


1 

JANTXV1N4121-1 

Diode, Zener 38V 

Dcdr 

N 


4 

immwww 


Dcdr 

N 


1 

JANTXV1N5711 

Diode, General Purpose 

Rcvr 

N 


1 



K2S1 

N 


1 


Opto Isolator 

Dcdr 

N 


5 

| JAVTXV2N2857 

Transistor, NPN,RF 

Rcvr 

N 




Feed-Thru 

Rcvr 

N 


2 

KK,HIMKaaiBM 

IC,0P-AMP " 

Rcvr 

N 


4 

EMM » — 

Cap, 1 uF leaded 

Dcdr 

N 


1 

MG87C196KC-16 

Microcontroller 

Dcdr 

N 

Qualification in 
process. 5662- 
990692 

2 


Progmmable System Device 

Dcdr 

N 

MIL-STD-883C 
Level B part will be 
available early in 
1992. 

1 


Thermistor 4.3K 

Rcvr 

N 


1 

| RTH44BS682G 

Thermistor 6.8K 

Rcvr 

N 
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5.11 Lightning Susceptibility 


5.11.1 Introduction 

The existing range safety system for the shuttle 
uses grounded quarter wave transmission lines 
for lightning protection. Simulated lightning 
tests, performed by Lightning Technologies, Inc. 
in December 1987 (Reference 1, Fisher) showed 
that the existing system is tolerant to lightning 
strikes. SAW devices offer several advantages 
over cavity tuned input circuits but their tolerance 
to lightning strikes needs to be considered. The 
following discussion provides an investigation of 
this tolerance by using computer modeling and 
simulation. 

The RF input to the present IRD consists of a 
tapped inductor resonated with a capacitor. The 
base lead of a field effect transistor (FET) also 
attaches to the RF input. This circuit looks like a 
short circuit at DC and an open circuit at fre- 
quencies much greater than one gigahertz. The 
circuit resonates at 416.5 MHz where it has an 
input impedance of 50 ohms. 

CE recommends replacing this circuitry with a 
surface acoustic wave (SAW) filter for signifi- 
cantly improved performance. Use of the SAW 
significantly changes the off-frequency input 
impedance of the ARD. The SAW looks like an 
open circuit at DC and at high frequencies. It is 
tuned to 416.5 MHz where it presents 50 ohms to 
the input. Since most of the energy in a lightning 
strike is at the lower frequencies, the difference 
between a short circuit and an open circuit has a 
large effect on the voltages and currents at the 
ARD input. The computer simulation presented 
analyzes the system voltages and currents, and 
presents modifications to the circuit 

Models generated for this investigation include: 
the lightning pulse, the present IRD input circuit, 
the Advanced RecelvSr/Decoder (ARD) SAW 
input circuit, the existing Shuttle cabling system, 
and the recommended Shuttle cabling system. 
The models agree well where they can be com- 
pared to actual circuitry. Where comparison is 
not available, best estimates were made. Models 
were generated using RF Designer and PSpice 


application software for the Macintosh computer. 
RF Designer is an RF analysis program similar to 
Super Compact. It is more suited to analysis over 
the frequency range of 300 kHz to 1.0 GHz for 
generating models of the ARD input and the SAW 
filter. 

PSpice was used for transient analysis runs. 
Models determined using RF Designer were 
transferred to PSpice, where an AC analysis and 
selected transient analyses were generated to 
check the accuracy of the transfer. 


5.11.2 The Lightning Pulse 

(References 3, Uman, and 2, Frisoni) Lightning 
will generate many different current waveforms. 
The two most important ones are termed classical 
and slow. In the classical case, the current will 
build up to about 100 amperes and remain at this 
level for 0.2 to 0.5 seconds. In addition, fast, 
high current surges will occur lasting on the order 
of a few milliseconds with a sharp peak lasting 
from 20 to 200 microseconds. The level of these 
surges can be anywhere from a few kiloamperes 
to over 100 kiloamperes. The number of surges 
in a single lightning strike can be large. The fast 
current surge case is important because of the 
magnitude and speed of the surges. High fre- 
quency energy is present that could potentially 
induce damaging voltages and currents in the 
IRD. The study done by Lightning Technologies, 
Inc. did show system limiting effects for very 
high current pulses where vaporization of the 
input cable limited voltages at the IRD. Lower 
level pulses will not have this effect due to the 
short duration of the pulse. 

In the slow case, only the 100 ampere current will 
flow. The slow case is important because it 
emphasizes the current and power handling capa- 
bilities of the IRD for long periods of time. 

This study separately analyzes the high frequency 
phenomena (above 1 MHz) and the low frequency 
effects. Below 1 MHz, the coaxial cables and the 
coupler can be ignored except for power dissipa- 
tion which simplifies the circuit to a resistor 
network. 
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A current pulse was simulated which peaks at 0.5 
microseconds and decays with a time constant of 
about 350 microseconds. This pulse is consistent 
with return strokes after the first stroke and gives 
a worst case rise time (Reference 3, Uman). 
Figure 17 is a schematic of the simulation circuit 
and a plot of the resulting current pulse. The 
pulse peaks at about one kiloampere and can be 
scaled as desired. 

Lightning Technologies, Inc. (Reference 1, 
Fisher) generated the current pulse by discharging 
a capacitor into the circuit. This action resulted in 
a damped sinusoid with a frequency of about 62 
kHz for the low level tests and 15 kHz for the 
high level tests. CE modelled this with a senes 
RLC network. Figure 1 8 illustrates the schematic 
and current pulse. 

The high frequency energy in these pulses occurs 
due to the abrupt current change at the beginning 
of the discharge. The shape of the pulse after the 
start of the discharge has little RF energy and can 
be ignored when studying the high frequency 
response of the networks. The pulse as generated 
by Lightning Technologies is used in this report 
for the high frequencies and can be compared to 
actual measured data. 

The current pulse from Reference 3 and the pulse 
from Lightning Technologies have very different 
wave shapes and some explanation is in order. 

1 . The pulse from Reference 3 is what occurs 
in nature and can be examined by simu- 
lation. 

2. The pulse from Lightning Technologies is 
limited by the capabilities of the test equip- 
ment. 

3 . The pulse from Lightning Technologies is 
used to verify the results of the simulation. 

4. The pulse from Reference 3 will be used to 

study the DC ancTlow frequency effects on 
the Range Safety System and IRD. 

5.11.3 Modelling the IRD 

CE measured the input impedance of the IRD 
using an HP 87 53 A network analyzer. Figure 19 


illustrates this measured data. Constructing a 
model for the IRD is simple due to the simple 
design and low stray impedances. Figure 20 
shows the schematic diagram of the model and the 
calculated input impedance using RF Designer. 
Inductor L2 is the lead inductance of the Field 
effect transistor (FET), and resistor R1 is the 
input impedance of the FET. 

Figure 21 contains the schematic diagram of the 
model for PSpice. The circuit changes slightly 
due to implementation. Figure 21 also shows the 
calculated input impedance using PSpice. A 
comparison of Figures 19, 20 and 21 shows good 
correlation between the measured input impedance 
and that calculated using the programs. 


5.11.4 Modelling the SAW Filter 

The model for the SAW filter is significantly more 
complicated. The measured input impedance for 
the SAW filter. Figure 22, shows a more 
involved process than that for the IRD. The data 
on the SAW filter was automatically measured, 
and RF Designer was used to plot the data. The 
figure shows plots for the broadband response 
(300 kHz to 1 GHz) and for the narrowband 
response (412 MHz to 420 MHz). Use of RF 
Designer resulted in a model which closely 
matches the measured data. Figure 23 shows the 
schematic for the model and the calculated input 
impedance. 

The two shunt resonant circuits model the narrow 
band of the SAW. Components LI A and CIA 
model the internal matching inductor and the open 
circuit nature of the SAW. The transmission lines 
act to rotate the input impedance to the proper area 
of the Smith Chart. Spurious resonances occur 
in the model at 64 MHz and at 700 MHz which do 
not appear in the SAW data. The resonance at 
700 MHz is at a sufficiently high frequency and 
can be ignored. The resonance at 64 MHz is sig- 
nificant in that the combination of input coax and 
lightning stub resonate near this frequency (56 
MHz). Care must be taken to assure that this 
resonance does not affect the data. This reso- 
nance has a high Q and occurs over a 2 MHz 
range. As long as the resonances in the other 
parts of the network do not coincide, this reso- 
nance will have no effect. 
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Prot>« 4.05 O 1991 MicroSlm Corp. 


Figure 21. Model of Present IRD RF Input Using PSpice 
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Figure 23. SAW Filter Model Using RF Designer 
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The circuit, transferred to PSpice, behaved simi- 
larly and is shown in Figure 24. These runs 
verify that the models accurately reflect the mea- 
sured data at least from an AC perspective. Some 
transient runs were performed (not shown) using 
a sine wave at 416.5 MHz to further verify the 
models and fine tune the simulation. In con- 
clusion, the models generated for the IRD and 
SAW filter have sufficient accuracy to be used for 
simulation. 


5.11.5 Modelling the IRD Cabling System 

Figure 25 shows a typical configuration of the 
Range Safety system for two antennas and two 
IRDs. This figure also shows the cable lengths 
which will be used when modelling the overall 
system. One cable, X31W415R, was removed 
because the system tested by Lightning 
Technologies used an input cable length of 27 to 
30 inches. (Reference 1, figures 80 and 85). The 
type of cable used is M17/128-RG400 which has 
a DC resistance of 0.91 ohms per 100 feet. The 
approximate fusing current for this cable is 130 
amperes DC, based on 19 strands of 32 AWG 
wire with 7 amperes fusing current each. 

Figure 26 shows a representative model for the 
system using RF Designer. Figure 27 shows the 
system model using PSpice. Figure 26 uses the 
IRD model and Figure 27 uses the SAW model. 
Both RF Designer and PSpice use both models as 
appropriate. The model for the hybrid coupler 
uses four transmission lines of appropriate 
lengths. A small length of transmission line 
replaces the directional coupler. Transmission 
lines were combined in the PSpice model for 
simplicity due to the time and memory intensive 
nature of transient modelling. 


5.11.6 Simulating the System 

CE first studied the System model from an AC 
standpoint. The parameter used for comparison is 
the input impedance of the system. Figure 28 
shows the magnitude of the input impedance in 
decibels for the baseline system and IRDs. This 
figure presents plots from RF Designer and 
PSpice. Study of the figure shows both pro- 
grams generating closely similar responses. The 


IRD tuned network is evident at 416 MHz. The 
multiple responses are a result of the various 
resonances in the cabling. The coupler passband 
and lightning stubs manifest as a lack of 
responses between 300 and 500 MHz where the 
system is essentially 50 ohms except for the IRD 
impedance. 

Figure 29 shows the response of the system with 
SAW filters as the frequency selective element in 
the ARDs. The high Q of the SAW can be seen 
from the very sharp response at 416.5 MHz. 
Again the plots show close agreement between 
RF Designer and PSpice. 

CE began the lightning analysis by modelling the 
system used by Lightning Technologies. CE 
modelled the three kiloampere damped sinusoid to 
verify the system simulation. Figure 30 and 31 
show the response of the system measured at the 
base of the field effect transistor, the same point 
of measurement used by Lightning Technologies. 
Figure 30 shows the coarse structure of the 
response and corresponds to figure 18 of the 
study (Reference 1, Fisher). The resonance at 56 
MHz is evident and is the result of the input coax 
and lightning stub. This response dies out in 
about one microsecond and has the same magni- 
tude as measured in the study. Other lower 
frequency responses can be seen and are the result 
of resonances of other cable lengths existing in 
the system. 

Duplication of the results of the Lightning 
Technology study allowed increasing the magni- 
tude of the current pulse to 100 kiloamperes. 
Again the pulse used was the same as used in the 
study. The frequency of the pulse was set to 17 
kHz, the same as used by the study. Figure 32 
shows the response measured at the IRD. This 
response compares favorably with figure 84 of 
the study. The peak magnitude is on the order of 
20 to 25 volts peak to peak and the response dies 
out in about one microsecond. 

SAW filters replaced the IRD input circuitry after 
verification of the model. This portion of the 
analysis attempts to extrapolate the effects of 
SAW filters in the presence of lightning. The ring 
coupler was retained for this analysis because of 
the difficulty in modelling CE's recommended 
coupler on PSpice. 


58 


/ t — 7 CINCINNATI 
LJj-1 7 ELECTRONICS 






X31W417R 



Figure 25. Typical Range Safety System Interconnection 
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Figure 27 . Range Safety System with SAW Filters in IRDs Using PSpice 
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0 RFD IRD Analysis 


RFDssignsr™ 01-09-1992 * 


500 600 

40 FREQUENCY [MHz]; 100 MHz/div FI- 1 ; F2- 1000 


Figure 28. Input Impedance of RSS Comparing RF Designer and PSpice 
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O.Ous 0.2us 0.4us 0 . 6us 0.8us 

O V(7B) 

Time 

"PS RSSBASE IRD SIN Friday, January 17, 1992 9:11 AM" 01/23/92 14:14:53 27.0* 

Probe 4.05 O 1991 MicroSim Corp. 


1 . Ous 


Figure 30. Baseline Transient Run at Three Kiloampere Level, to One Microsecond 
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40ns 44na 48ns 52ns 

□ V { 7 B) 

Time 

“PS RSSBASE IRD SIN Friday, January 17, 1992 9:11 AM* 01/24/92 07:53:14 

Probe 4.05 © 1991 MicroSim Corp. 


Figure 31. Baseline Transient Run at Three Kiloampere Level, to 60 Microseconds 
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First, the three kiloampere pulse was injected into 
the system containing SAW filters. Figure 33 
shows the result. The voltage, V(1SB), is the 
voltage at the SAW device, after the matching 
inductor. As expected, the voltage at the SAW is 
much higher due to the fact that the SAW appears 
as an open circuit to the primary system resonance 
frequency of 56 MHz. The voltage peaks at 100 
volts. If this were extrapolated to a current pulse 
of 100 kiloamperes, the voltage would be on the 
order of 3000 volts. This is sufficient to destroy 
the SAW filter. The current flowing into the 
SAW is small, again due to the open circuit 
characteristic. 

This result indicates a need to modify the system 
circuitry to limit the voltage at the SAW filters. 
Since the system recommended by CE includes 
the coupler designed by CE and has quarter wave 
stubs, these were added to the model. Also 
quarter wave stubs were added at the input to the 
IRD and can be incorporated into the ARD. In 
addition, diodes, 1N4150, were added in parallel 
across the input of the ARD. These diodes have 
a reverse earner lifetime of 5 nanoseconds and 
help to limit the voltage. Figure 34 indicates the 
reduction of the voltage at the SAW filter from 
these improvements. The response at 56 MHz 
now appears in the diode voltages and currents. 
The response at 400 MHz dominates inside the 
SAW filter. 

The voltage labelled V(6B) is the voltage at the 
input to the ARD. Comparison of V(1SB) and 
V(6B) shows that the SAW filter is ringing at 400 
MHz due to the pulse. There is little evidence of 
ringing at the input to the ARD. The voltage, 
V(6B), and diode current, I(D3B), are offset to 
make analysis of the figure easier. 

Figure 35 shows the result of a 100 kiloampere 
pulse when SAW filters are used. Again, V(6B) 
and I(D3B) are offset. The voltage at the SAW 
device is less than 1 Q^ volts and lasts for only a 
few RF cycles. This'level is well within the peak 
voltages recommended by SAW manufacturers. 
Also, 100 kiloamperes is a worst case scenario. 


and the great majority of lightning surges will be 
less than this. 

The current in the diode peaks at four amperes 
lasting about five nanosecond. The diode has a 
surge current rating of four amperes for one 
microsecond. Therefore, the diode can handle the 
short duration of this current. 

Because the diode is a nonlinear device, CE tested 
the configuration described above using an exist- 
ing receiver for degradation in intermodulation 
distortion (CS03 of MIL-STD-461) and undesired 
signals (CS04 of MIL-STD-461) performance. 
CE detected no change in the receiver perfor- 
mance, indicating that circuits other than the 
diodes control the performance of these 
parameters. 


5.11.7 Low Frequency Analysis 

Most of the energy of a lightning pulse occurs at 
frequencies below one MHz. At these frequen- 
cies and for this application, the coax cables and 
the coupler can be modelled essentially as if the 
analysis were DC. Also, accurately modelling the 
lengths of the cabling in the range safety system 
limit analysis over long periods of time because 
the size of the time step that can be taken is 
limited. Therefore the coax in the system was 
simplified to the DC resistance of the coax and the 
model of the recommended coupler was reduced 
to the direct path only. Only one IRD and one 
antenna are needed in this simplified model. 
Figure 36 shows this system. This model 
includes the resistances of the coax and the con- 
nectors which are added together in each branch 
and modelled as a single resistor. The resistance 
used for each connector is 0.003 ohms. The 
resistance of each coax is dependent upon its 
length. Resistor R1 STUB is the model of the 
existing lightning stub. Resistor R2STUB is the 
model of the quarter wave stub in the coupler. 
Resistor RIRD is the quarter wave stub in the 
ARD. The current pulse used is that of Figure 
17, shown earlier, scaled to 100 kiloamperes. 
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Figure 33. Transient Run at Three Kiloampere Level Using SAW Filters 
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Tim* 


"PS RSSBASE SAW SIN Monday, January 27, 1992 8:42 AM" 02/06/92 16:05:10 27.0* 

Prob* 4.05 O 1991 MicroSim Corp. 


Figure 34. Transient Run at Three Kiloampere Level with Diodes and Stubs Added 
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□ I (DIB) ■ I (D3B) -2 

Tim# 

"PS RSSBASE SAW SIN Monday, January 27, 1992 8:42 AM" 02/06/92 11:29:35 27.0 

Prob# 4.05 O 1991 MicroSim Corp. 

Figure 3S. Transient Run at 100 Kiloampere Level With Diodes and Stubs Added 
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Figures 37 and 38 show the current and voltage 
waveforms at various points in the range safety 
system (RSS) and are described as follows: 

• I(RIRSS) - input current to RSS 

• V(4L) - voltage at input to RSS 

• I(R2STUB) - current flowing in stub in 
coupler 

• I(RIRD) - current flowing in stub in IRD 

• I(D 1 ) - current flowing in a diode in IRD 

• V(1IRD) - voltage across diodes in IRD 

As can be seen, the currents significantly exceed 
the cable ratings and can cause damage as seen by 
Lightning Technologies during their tests. In 
addition, the voltage rating on the connectors is 
500 volts rms. Assuming that arc over will occur 
at 1000 volts, the voltages seen in the system can 
easily be greater than the system can stand. 
Arcing was also seen by Lightning Technologies. 
Lightning Technologies experienced arcing at 25 
kiloampere levels which indicates that the 1000 
volt limit is representative of this system. 

Since arcing occurs, the current that actually 
travels down the coax is limited to a lower value 
than indicated in the figures. If the maximum 
input voltage is 1000 volts, then the maximum 
input current is about 20 kiloamperes, the rest 
being shunted by the arc. The currents in the 
system are similarly reduced. The conclusion that 
can be drawn here is that lightning strikes of less 
than 20 kiloamperes will not arc over and all the 
current of the pulse will enter the coax. 

CE calculated the time required to melt the input 
coax and the quarter wave stub at the coupler 
using the following simplified heat capacity 
model. 

T(t) = T^ + (q/hAX* [ 1 -exp(-hAt/CpV)] 
where: 

T(t) is the temperature at time t 


q is the input power in watts 

h is the transfer coefficient of copper in 
W/(m A 2*°C), 1.0 for this analysis 

C is the heat capacity of copper in joules 
per kg per °C = 380 

p is the density of copper in kg per m A 3 
= 8954 

A is the cross sectional area in m A 3 

V is the volume in m A 3 

The approximate time required to melt the stub in 
the coupler (R2STUB) is 95 milliseconds, assum- 
ing 1000 amperes is flowing. The approximate 
time required to melt the input coax is 240 
microseconds, assuming 19000 amperes is flow- 
ing. Since this pulse lasts on the order of a few 
milliseconds, there is a high likelihood that the 
input coax will melt This occurred in the tests by 
Lightning Technologies at pulse current levels of 
100 kiloamperes. Apparently enough current was 
able to enter the coax for a long enough period of 
time to cause melting. 

When only the slow lightning pulse, consisting of 
about 100 amperes for one half second occurs, a 
DC analysis is appropriate. The DC current 
capacity of the coax cables, using the simplified 
analysis, is capable of handling 400 amperes for 
one half second. The quarter wave stub in the 
coupler will carry significantly less current 
because of the shunting of the first stub and will 
not melt for greater than 100 seconds. Therefore, 
the cabling in the range safety system should be 
capable of handling the slow lightning pulse. 

Figure 38 shows approximately 3 amperes flow- 
ing in a diode for 100 kiloamperes of input 
current Assuming arcing will limit the input cur- 
rent to about 20 kiloamperes, the diode current 
will be on the order of 200 milliamperes. The 
diode is rated at 500 milliamperes for one second. 
Since the current surge lasts for only a few 
milliseconds, the diode will be able to withstand 
the surge. 
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Figure 37. Selected Outputs From Low Frequency Analysis, Part One 
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Figure 38. Selected Outputs From Low Frequency Analysis, Part Two 
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5.11.8 Lightning Susceptibility 
Recommendations 

Surface acoustic wave filters can be used in the 
IRD when the following changes are made to the 
system. A quarter wave stub is necessary at the 
coupler, either inside or outside the coupler. CE 
will add a stub inside the IRD and place parallel 
diodes across the input of the SAW. A small 
matching network consisting of a series inductor 
and a shunt capacitor will compensate for the 
added capacitance of the diodes. The MMIC 
amplifier following the SAW will see little RF 
energy. The transient is short, lasting nanosec- 
onds and the voltage is not able to build up at the 
filter output. 


5.12 Power Consumption 

Standby mode power consumption for the present 
IRD is 12 watts nominal, and 15 watts maximum. 
The ARD, in standby mode, consumes 3.3 watts 
of power nominal, and 4 watts maximum. This 
difference represents a reduction in power by a 
factor of 3.6 times. Table 16 summarizes the 
changes and shows how the power is allocated to 
the modules of the recommended design. 


5.13 Mounting/Mating Connectors 

Disassembly of the present IRD to separate the 
receiver from the decoder requires unsoldering 30 
flexprint terminals. During this study, the pack- 
aging concept was changed to greatly simplify 
physical isolation of and access to the basic IRD 
modules. 

As a result of the large overall reduction in parts 
count, only three printed circuit boards are nekied 
for the new ARD. Using a “clamshell” approach 
as shown earlier in Figure 16, New Case Design 
Concept, the Receivercan be separated from the 
decoder very easily by removing the connecting 
bolts and unsoldering 5 flexprint terminals. 
Access to the decoder/command output and power 
supply boards is immediate and access to the 


receiver board requires only removal of a shield 
cover. 

5.14 Software 

The architecture of the 87C196KC is similar to 
that of the SBP9989. Both devices do 
register-to-register operations and do not have an 
accumulator. Because of the similarity, the soft- 
ware structure for the ARD will be essentially the 
same as that for its predecessor. The present 
software will be translated to 87C196KC code 
with additions and modifications as required for 
implementation of the new features. 

5.14.1 Instruction Execution Times 

The 87C196KC operates at a higher clock fre- 
quency and has an average instruction execution 
time that is less than the SBP9989. A comparison 
of operating times is shown in Table 17. 

Taking into account the instruction length and 
cycle times the 87C196KC device is five times 
faster than the SBP9989 as used in the present 
IRD. The Average instruction length figures were 
determined by the coding of three selected 
routines used as bench marks. The Relative 
Speed is adjusted to 3/1 to allow for benchmark to 
actual code variations. 


5.14.2 Data Sample Storage 

The storage of data samples taken by the A/D 
Converter in the present IRD is accomplished by 
Direct Memory Access (DMA) implemented by 
peripheral hardware that temporarily stops the 
CPU operation and writes A/D data to RAM. The 
timing overhead for this process is 10%. 

The 87C196KC has the capability of providing 
DMA-like data transfers from the A/D converter to 
RAM using the Peripheral Transfer Server (PTS) 
function which is performed without external 
hardware and without CPU intervention. The 
timing overhead for this function is 13%. 
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Table 16. Power Consumption Comparision 


Parameter 

Present 

Design 

Recommended 

Design 

Standby Power 

15 watts max. 

4 watts max. 


12 watts nom. 

3.3 watts nom. 

Command Mode Power 

20 watts 

1 1 watts 




Module 



RF/IF 


0.8 watts 

Decoder 


1.7 watts 

Power Supply 



Efficiency 


75%, minimum 

Power 


0.8 watts 


Table 17. SB9989 and 87C196KC Timing Comparison 


Parameter 

SBP9989 

87C196KC 

Clock Frequency 

2.9568 MHz 

15.5904 MHz 

Cycle Time 

338 ns 

128 ns 

Average Instruction Length 


BHI 

Relative Instruction Speed Per Benchmark 

1 

5 

Relative Instruction Speed Adjusted 

1 

3 


6.0 COMBINING OTHER FUNCTIONS 

In the present Range Safety System, command 
outputs from the IRD are routed through a 
Distributor and a Safe and Arm (S&A) Device to 
the NASA Standard Detonator. Each of these 
equipments is housed in a separate "black box". 
The largest of these boxes is the Distributor that 
performs the following functions: 

• Command Cross-strapping. 

• Battery Power Regulation. 

• Safe and Arm Device Control. 

• Pyrotechnic Initiation. 

• Provides RSS Telemetry Signals. 

• Electro-Explosive Device (EED) Test and 
Telemetry. 


Advances in technology have made possible a 
considerable reduction in Receiver/Decoder size 
with the new ARD design. In addition, the pre- 
sent Distributor functions can be incorporated into 
the new design to provide an Enhanced 
Receiver/Decoder (ERD). The implementation of 
this ERD is discussed in the subsequent para- 
graphs of this section. 


6.1 Embedded Hybrid Coupler 

A method for eliminating the external directional 
coupler and hybrid coupler in the existing Range 
Safety antenna system has been investigated. 
The following changes are required: 

• Embed one half of the hybrid coupler in 
each Receiver/Decoder. 
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0 Employ one step crypto encoding in the 
Receiver/Decoder which eliminates the need 
for closed loop testing and makes the direc- 
tional coupler unnecessary. 

Implementation of these changes is described in 
the remainder of this paragraph. 

A block diagram of the existing antenna system 
used in the Shuttle Range Safety System is shown 
in Figure 39. Two antennas feed a hybrid coupler 
which then feeds two IRDs. Additionally, a 
directional coupler is inserted between antenna 2 
and the hybrid coupler. This directional coupler 
allows an RF input from a test set to be fed into 
the hybrid coupler during closed loop testing. 

A block diagram of the embedded antenna system 
for the Shuttle Range Safety System is shown in 
Figure 40. The hybrid coupler can be imple- 
mented within each Receiver/Decoder (R/D). In 
the embedded system, one antenna feeds one R/D 
directly and each R/D provides a coupled output 
from its antenna to the other R/D. In the system 
used on the external tank where only one IRD is 
present, both antennas feed the same R/D. 

The directional coupler is eliminated by using a 
method called “one-step crypto”. Using the one- 


step crypto system, open loop testing can be per- 
formed without compromising security. Thus, 
open loop testing eliminates the need for the exist- 
ing closed loop testing. One-step crypto is 
described in Section 7.0. 

Initial analyses indicate that the hybrid coupler can 
be implemented within each IRD, as mentioned 
above, without sacrificing reliability or perfor- 
mance. 

Current operational procedure for the high alpha- 
bet system is to use unclassified test codes for 
pre-flight testing. After loading secure flight 
codes (a short time before launch) the system is 
tested with very low RF power using a shield 
over the vehicle antenna or a directional coupler to 
avoid detectable radiation outside the secure zone. 

RF radiation could also be avoided by using an 
umbilical input direct to an isolated baseband 
input on the FTR. 

During technical interchange discussions with 
MSFC, it was learned that the umbilical input is 
also used to verify IRD sensitivity. If the umbili- 
cal is eliminated, finding another way to get 
sensitivity data is necessary. 



Figure 39. Existing Antenna System for Shuttle Flight Termination System 
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Antenna 1 


Antenna 2 



Figure 40. Proposed Antenna System for Shuttle Flight Termination System 


6.2 Embedded Distributor Functions 

The Distributor of the current range safety sy stem 
handles a variety of functions which are listed 
below: 

• Isolation and interconnection for cross- 
strapped "Arm" and "Fire" commands 
between the SRBs and to the ET. 

• Regulation and control of power to the 
RSS. 

• Control of the Safe and Arm (S&A) Device 
in response to Orbiter or LPS commands. 

• Pyrotechnic Initiation by High Alphabet 
Arm-Fire Commands and inhibit for 
prelaunch operations. 

• Provide RSS status to Telemetry and Arm 
status to crew. 

• Measure Electro Explosive Device and send 
result to Telemetry. 

Each of the above functions can be incorporated 
into the Enhanced Receiver/Decoder (ERD) 
design. Additionally, the ISDS function, as dis- 
cussed in section 6.5, can be added. Adding 
these functions to the ERD design requires the 
addition of connectors and circuitry to the 
Advanced Receiver/Decoder (ARD) described in 
section 4.0. This addition increases the overall 


size and weight of the new design presented in 
Section 4.0. 

6.2.1 Embedded Cross Strapping 

The present Solid Rocket Booster and External 
Tank Range Safety Systems each consist of dis- 
tribution and control circuitry which is external to 
the IRD. The Shuttle Range Safety System 
consists of the three subsystems listed below: 

• Left Solid Rocket Booster Range Safety 
Subsystem (L SRB RSS) 

• Right Solid Rocket Booster Range Safety 
Subsystem (R SRB RSS) 

• External Tank Range Safety Subsystem (ET 
RSS) 

Each of these subsystems includes an A and B 
System. Command pulses are cross strapped 
between the L SRB RSS, R SRB RSS and the ET 
RSS. The control distributor provides isolation 
and routing for the cross strapped Arm and Fire 
signals to/from the other SRB and to the ET from 
each SRB. The current Arm and Fire signals 
from the IRD have a pulse duration of approxi- 
mately 45 mSec. The A and B systems on the 
SRBs each receive only one cross strapped input 
and provide 2 cross strapped outputs. The A and 
B systems on the ET each receive two cross 
strapped inputs and provide no cross strapped 
outputs. 
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An improved technique is discussed in the 
remainder of this paragraph. This technique is 
based on the use of an Enhanced 
Receiver/Decoder (ERD) capable of performing 
the distribution and control functions as discussed 
in paragraph 6.2. For this approach a serial data 
link between systems is used. The ERD micro- 
controller of one system transmits/receives a serial 
word that is received/transmitted by the microcon- 
troller of another system. A unique serial data 
word is used for each command. The use of a 
unique serial word reduces the probability of 
random EMI triggering a system. The serial word 
is transmitted and processed within 45 msec to 
maintain timing compatibility with the current 
system. 

Each system is capable of providing 2 separate 
serial outputs for the purpose of cross strapping. 
In addition, each system is capable of receiving 2 
separate serial inputs for the purpose of cross 
strapping. Two serial inputs are provided on both 
the A and B systems of the SRB and two serial 
outputs are provided on both the A and B systems 
of the ET. Signal cross strapping is shown in 
Figure 41. A summary of the cross strapping 
functions is presented below. 

• The Left SRB system A is capable of 
transmitting to the ET system A and to the 
Right SRB system B. The Left SRB 
system A is capable of receiving from the 
Right SRB system B. 

• The Left SRB system B is capable of 
transmitting to the ET system B and to the 
Right SRB system A. The Left SRB sys- 
tem B is capable of receiving from the Right 
SRB system A. 

• The ET system A is capable of receiving 
from the Left SRB system A and from the 
Right SRB system B. 

• The ET system IT is capable of receiving 
from the Left SRB system B and from the 
Right SRB system A. 

• The Right SRB system B is capable of 
transmitting to the ET system A and to the 


Left SRB system A. The Right SRB sys- 
tem B is capable of receiving from the Left 
SRB system A. 

• The Right SRB system A is capable of 
transmitting to the ET system B and to the 
Left SRB system B. The Right SRB sys- 
tem A is capable of receiving from the Left 
SRB system B. 


6.2.2 Regulation and Control of Power 

The ERD design operates over a broad range of 
input supply voltages. The regulation circuitry 
accepts die battery input and regulates the battery 
voltage as necessary. Figure 42 illustrates power 
distribution for this design. 

Two analog signals are provided to monitor the 
voltage and current of the battery. The current 
monitor is the voltage across a current shunt 
between the negative terminal on the battery and a 
common return bus on the power supply. This 
shunt is implemented on a 2 oz. copper strip 
located on an internal layer of the power supply 
PWB. The shunt has a resistance of a few 
milliohms which provides an output voltage 
between 0 and 50 mV over the range of 0 to 
Imax. The voltage monitor is obtained from the 
battery voltage bus. 

The RSS "Power On" and "Power Off" 
Commands control the application of power to the 
ERD via a normally open switch. Application of 
the "Power On" signal closes the switch. 
Application of the "Power Off' signal opens the 
switch, regardless of the status of the "Power On" 
signal. Isolation of the control inputs is accom- 
plished using optocouplers. Figure 43 shows 
control of the power latch. 

Control signals from either the 5 V configuration 
or the 28 V configuration are acceptable. Two 
input pins exist for each drive input. One input 
pin is used for the drive inputs in the 5 V config- 
uration and the other input pin is used for the 
drive inputs in the 28 V configuration. 
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Figure 41. Signal Cross Strapping 
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Figure 42. Power Distribution 
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Figure 43. Power Latch Control 


6.2.3 S&A Device Control 

Control of the Safe and Arm Device can be 
accomplished within the ERD. Figure 44 illus- 
trates the design approach. The RSS S&A 
control signals for Safing and Arming the S&A 
Device are isolated from the switches using an 
optoisolator. Control signals from either the 5 V 
configuration or the 28 V configuration are 
acceptable. Two input pins are provided for each 
drive input. One pin is for 5 V drive and the other 
for 28 V drive. 

The switches are similar to the command output 
circuitry currently used in Cincinnati Electronics 
range safety receivers. These switches are nor- 
mally open and can provide 3 amp continuous 
current with minimum voltage drop upon activa- 
tion. Note that unswitched +28 VDC is the signal 
applied to the S&A Device via the S&A switches. 
This connection allows Safing and Arming to be 
accomplished regardless of the state of the power 
latch. 


6.2.4 Pyrotechnic Initiation and Pre- 
launch Pyrotechnic Inhibit 

Pyrotechnic initiation can be accomplished with 
circuitry contained within the ERD. Figure 45 is 
a block diagram of the Fire circuitry. 

Unswitched +28 VDC is applied to the Arm latch. 
Once the Arm latch has been activated, the Fire 1 
latch can then be activated. With the Arm and 
Fire 1 latches both activated, Pyrotechnic 
Initiation occurs with the activation of the Fire 2 
latch. The RSS Inhibit/Reset signal can inhibit 
activation of Arm, Fire 1, and Fire 2 latches. 
Additionally, the RSS Inhibit/Reset signal can 
reset the Arm, Fire 1, and Fire 2 latches once 
they are set 

Drive signals for the command latches are pro- 
vided by the decoder. These signals are redun- 
dant. Decoder logic is provided to ensure that the 
Fire 1 latch is not set before the Arm latch is set. 
Logic is also provided to prevent setting the Fire 2 
latch before the Fire 1 latch. This logic is 
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implemented in both hardware and software on 
the decoder. 

Redundancy circuitry is used to check each of the 
three output latches, Arm, Fire 1, and Fire 2. 
Figure 46 illustrates the redundancy check 
circuitry. Two Redundancy Flags provide latch 
status to the decoder. These Redundancy Flags 


are checked during unit self test to ensure that 
none of the latches are shorted. Table 18 shows 
the flag status for various output switch 
conditions. The flags are active low level. A 
shorted Arm latch activates Redundancy Flag #1, 
a shorted Fire 2 latch activates Redundancy Flag 
#2, and a shorted Fire 1 latch activates both 
Redundancy Flags as shown in the table. 


+28VDC Unswitched 



Redundancy 
Flag #1 


Redundancy 
Flag #2 


Table 18. Redundancy Circuit Operation 



VB1 

STATUS 


RED 
FLAG #1 

RED 

FLAG #2 

NONE 

V1>VB1>V2 

V3>VB2>V4 

1 

1 

ARM 

V1<VB1>V2 

V3>VB2>V4 

0 

1 

FIRE 1 

V1<VB1<V2 

V3<VB2>V4 

0 

0 

FIRE 2 

V1>VB1>V2 

V3>VB2<V4 

1 

0 


j } ^ CINCINNATI § 
/ / *7 ILECTRONICH § 


84 



























Next Generation IRD Study 


6.2.5 RSS Status Telemetry 

The ERD provides the status of the RSS to 
telemetry. The S&A status signals are routed 
through the ERD from the S&A Device. All other 
status signals are generated within the ERD. The 
following describes RSS status signals that are 
available to telemetry. 

S&A Device Telemetry 

The following signals are provided: 

• A +5 VDC signal from the MDM is routed 
to the S&A Device via the ERD. This signal 
is switched by the S&A Device to provided 
the S&A status signals (ARMED and 
SAFED). 

• A S&A Device ARMED and SAFED signal 
status signals from the S&A Device which 
are routed through the ERD to the MDM. 

ISPS Telemetry 

The following signals discussed in paragraph 6.5. 
are provided: 

• Status for breakwires BW la, BW 2a, BW 
lb, and BW 2b. 

• ISDS Safe/Arm Telemetry output to indicate 
the status of the ISDS system. 

ERD Telemetry 

The following signals described in Section 4.0 are 
provided: 

• Pilot tone Telemetry. 

• Precision Signal Strength Telemetry. 

Pyrotechnic Initiation Telemetry 

The following Pyrotechnic Initiation Telemetry 
signal are provided: 

• Arm Telemetry output to indicate that the 
Arm Command has been received and that 
the Arm latch has been set. 

• Fire Telemetry output to indicate that the 
Fire Command has been received and that 


the Fire latches have been set. A separate 
Fire Telemetry output for each of the Fire 
latches can be provided if preferred. 

• Inhibit/Reset Telemetry output to indicate 
that the Inhibit/Reset signal is present. 
Redundancy flag signals can be provided. 

• Finally, a separate output is made available 
as an indication to the crew that the Arm 
latch has been set. 

6.2.6 Electro-Explosive Device (EED) 
Test and Telemetry 

An Electro-Explosive Device (EED) Monitor 
circuit provides an indication of the resistance 
across the Fire output. The EED Monitor circuit 
provides a voltage proportional to the resistance 
across the Fire output. This proportional voltage 
is conditioned to provide a specific voltage for a 1 
ohm load. Activation of a self test command 
causes a current source to supply 15 mA into the 
Fire output for approximately 5 seconds, 
generating the telemetry voltage. An isolation 
amplifier isolates the EED telemetry output from 
the Fire return. The maximum voltage across the 
Fire output during the test is limited to less than 1 
Vdc. The failure of any single component will 
not cause more than 1 volt across the Fire output 
or more than 40 mA to flow through the Fire 
output. Figure 47 is a block diagram of the EED 
Monitor. 


6.3 Inadvertent Separation Destruct 
System (ISDS) 

6.3.1 Introduction 

The purpose of ISDS is to generate an automatic 
Arm-Fire (Destruct) command signal sequence in 
the event of an inadvertent vehicle separation 
during the first 70 seconds of flight. During this 
time interval, operator response time is critical and 
an automatic initiation is effective. Because the 
flight is manned, ISDS may not be desirable. 
This option is discussed to show the 
implementation capability provided by the 
recommended ERD design. The technique 
described is used in present Receiver Designs. 
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Figure 47. EED Monitor 


6.3.2 General Description 

The ISDS circuit is enabled by an ISDS Arm 
signal and disabled by an ISDS Safe signal. 
These control signals are supplied to the ERD. 
ISDS operation is accomplished by monitoring 
two redundant pair wire loops. An Arm-Fire 
command sequence is generated only if both of 
the following conditions are met: 

• An open circuit (wire break) occurs in at 
least one loop of each redundant pair. 

• The break duration is greater than 40 
milliseconds. 

The Break Detect Logic of the ISDS function is 
implemented in an Erasable Programmable Logic 
Device (EPLD) which is shown in Figure 48. 
The ERD microcontroller monitors signals from 
the EPLD and generates an Arm-Fire command 
sequence when break criteria is met. 

Two ISDS breakwire connectors are provided 
with two breakwires per connector for a total of 4 
breakwires. The ISDS connectors are J6 and J7 


in Figure 48. The ISDS Safe signals and ISDS 
Arm signals enter the ERD on a third connector J8 
not shown in the figure. 

6.3. 2.1 ISDS Initiation 

If ISDS operation has been previously ARMED, 
the ISDS sequence is initiated after at least one 
breakwire from J6 and at least one breakwire 
from J7 are simultaneously opened for a period of 
40 milliseconds or greater. ISDS initiation will 
not occur for breakwire discontinuities of 20 
milliseconds or less. Initiation may or may not 
occur for breakwire discontinuities between 20 
and 40 milliseconds. 


6.3.2.2 ISDS Breakwires 

A breakwire is considered closed if its loop resis- 
tance is less than or equal to 1 Kohm. A 
breakwire is considered open if its loop resistance 
is greater than or equal to 100 Kohms. A break- 
wire may be considered open or closed if its 
resistance is between 1 Kohm and 100 Kohms. 
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AT LEAST 1 BW EACH CONNECTOR OPEN 


BREAK WIRE 1A 
BREAKWIRE 1A RETURN 


INTERFACE 


LOOP 1 TLM 


BREAKWIRE 2A 


BREAKWIRE 2A RETURN 


INTERFACE 


LOOP 2 TLM 


BREAKWIRE IB 
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Figure 48. Break Detect Logic EPLD 


Four ISDS loop telemetry monitors (one for each 
breakwire) are provided. The ISDS loop 
telemetry is high whenever the ISDS system 
senses a closed breakwire. The ISDS loop 
telemetry is low whenever the ISDS system 
senses an open. 


6.3.2.3 ISDS Loop Interrogation 

The loop driving voltage is derived from the 5 
volt source which is isolated from chassis and 28 
Volt return but is common with the telemetry 
signals. Connecting all pins of J6 and J7 to +28 


Vdc will not damage the unit nor will it prevent 
the unit from achieving any requirement other 
than those associated with the ISDS function. 
Connecting a breakwire to ground (when 28V 
return, chassis return, and telemetry return are 
shorted to this same ground) will make that 
breakwire look like it is open. 


6.3.2.4 ISDS Safe and Arm 

The ISDS Safe and Arm signals that control ISDS 
operation are each monitored by two input lines of 
the ERD microcontroller. 
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ISDS operation is enabled by the ERD microcon- 
troller when the proper voltage is applied across 
the ISDS Arm input for no less than 1 second. 
This signal is monitored by two ERD input lines. 
The ISDS function is deactivated when the proper 
voltage is applied across either of two ISDS Safe 
inputs provided for no less than 1 second. The 
ISDS function defaults to Safe when power is 
first applied to the unit. The ISDS function can- 
not be armed unless all four breakwires are 
closed. An ISDS Safe/Arm telemetry signal is 
provided by the microcomputer. This signal is 
high whenever the ISDS function is in the 
ARMED state. 


6.3.2.5 ISDS Fault Tolerance 

A failure of any single component will not result 
in an inadvertent output. 

6.3.3 Detailed Description 

Four continuity loops (breakwires) enter through 
connectors J6 and J7. Each breakwire has a drive 
signal and a sense signal. With the breakwires 
installed, the breakwire drive signal pulls the cor- 
responding breakwire sense signal to a high or 
logic 1 state. If the breakwire is not installed, or 
if a breakwire is broken, the breakwire drive 
signal cannot drive the corresponding breakwire 
sense signal. If the drive signal cannot drive the 
sense signal then the sense signal will be pulled to 
a low or logic 0 state. 


Two EPLD's provide the Break Detect Logic 
(Figure 48, shown previously) that monitors the 
status of the breakwire signals and provides 
breakwire status information for the micro- 
controller. Status information is provided in 
Table 19. 

The two EPLDs provide the same information to 
the microprocessor in order to accomplish redun- 
dancy. The following is a description of each bit 
in the ISDS status message. This status message 
is read by the microprocessor once every 
millisecond: 

• BREAKWIRE STATUS bits provide a 
snapshot of the corresponding breakwire 
status. If a breakwire is broken, the corre- 
sponding status bit will be a logic 1. If a 
wire is not broken the corresponding status 
bit will be a logic 0. 

• The BREAKWIRES REMAKE bit contin- 
ually monitors the breakwire status bit 
between status reads. If the breakwire is 
chattering (making and breaking) between 
status reads, then the BREAKWIRE 
REMAKE bit will capture the transition. 

The microcontroller reads the status of the ISDS 
EPLDs using alternating read selects. This 
approach is necessary to clear the flip-flops that 
are used to record the BREAKWIRES REMAKE 
bit. While reading (and thus clearing) one set of 
flip-flops, the other set is still active and able to 
detect breakwire chattering. 


Table 19. Breakwire Status Bit Assignment 


INPUT 

BIT 

SIGNAL NAME 

DATA DESCRIPTION 

BitO 

BWA-1 

Status of Breakwires A ISDS EPLD #1 

Bit 1^ 

BWB-1 

Status of Breakwires B ISDS EPLD #1 

Bit 2 

BW CHANGE- 1 

Breakwires remake ISDS EPLD #1 

Bit 4 

BWA-2 

Status of Breakwires A ISDS EPLD #2 

Bit 5 

BWB-2 

Status of Breakwires B ISDS EPLD #2 

Bit 6 

BW CHANGE-2 

Breakwires remake ISDS EPLD #2 
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The ISDS status is read approximately once every 
millisecond. If the STATUS OF BREAKWIRES 
bits are a logic 1 for 40 consecutive samples in 
both EPLDs without the BREAKWIRES 
REMAKE bit being a logic 1, then the ISDS out- 
put sequence will be initiated provided the ISDS 
function is ARMED. 

Each ISDS EPLD provides an ISDS_EN output 
which is fed to the command output devices. If at 
least one breakwire from each connector is broken 
then this signal will be a logic 1. If none (or only 
one) of the breakwires are (is) broken, then this 
signal will be a logic 0. The ISDS_EN must be a 
logic 1 to allow the hardware to accept an Arm 
command via ISDS. The Arm command initiated 
via ISDS is different internally than the Arm 
command initiated via the decoding of a high- 
alphabet Arm command. The Arm command 
initiated via the decoding of a high-alphabet Arm 
command does not depend on the ISDS_EN 
signal. 


6.4 ERD Packaging Concept 

Implementation of the Distributor functions in the 
Enhanced Receiver/Decoder does not increase the 
Receiver/Decoder package size a great deal. 
Many of the required functions are performed by 
software and the added peripheral circuits consists 
primarily of isolation, interface, and driver cir- 
cuits. The package described in this section is 
one used in a current CE product. The following 
discussion shows how this same package can be 
used for the ERD. 

The ERD package consists of 3 main mechanical 
components; chassis, bottom plate and top plate. 
The chassis has a groove in the top and the 
bottom that houses an environmental/EMI gasket. 
All of the connectors have an environmental/EMI 
gasket as well. This chassis contains 4 mounting 
holes. Figures 49 thru_55 illustrate the mechani- 
cal design. 

The ERD contains four multilayer printed wiring 
board (PWB) assemblies; the RF/IF, Power 


Supply, Decoder, and I/O. The boards contain 
both leaded and surface mount components. 
Power devices are mounted directly to the chassis 
to create a low thermal path. 

The Power Supply PWB is mounted in an 
enclosed cavity with a sheet metal cover to protect 
the unit from stray radiation. Most of the assem- 
bly interconnections are accomplished with 
flexprints. Conventional wiring is used for high 
current signals. 


6.5 Combining Other Functions Summary 

Assuming the directional coupler is still a 
requirement, the Hybrid Coupler and Directional 
Coupler can be combined into a single assembly. 
A single RF combiner (CE P/N 635179) can be 
used in place of the Hybrid Coupler and 
Directional Coupler. Table 20 compares parame- 
ters of the existing Hybrid Coupler/Directional 
Coupler with those of the RF Combiner. The RF 
combiner is a single assembly designed to provide 
the same function (directional coupler, hybrid 
coupler, and 50 ohm termination) as the two 
components used in the existing system. 

As a result of combining "other functions" within 
the IRD, the existing Distributor and Pyrotechnic 
Initiation Controller (PIC) can be eliminated from 
the Range Safety System. The distributor func- 
tions can be handled by the ERD. Fire initiation 
is accomplished with a high current output from 
the ERD. Also, an Inadvertent Separation 
Destruct System can be implemented if desired. 
A block diagram of a new system combining 
other functions is shown in Figure 56. The block 
diagram represents only one of the three systems 
used on the Shuttle. Each of the three systems 
contains two antennas, a single RF Combiner, 
two ERDs, two batteries, a single Safe and Arm 
Device, and two NASA Standard Detonators. 
The Confined Detonating Fuse Assemblies, 
Confined Detonating Fuse Manifold, and Destruct 
Assembly are not shown on the block diagram for 
convenience. 
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Figure 55. Cross-Section 
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Figure 56. ERD - RSS Block Diagram 
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Table 20. Existing System Vs. RF Combiner System 



Existing System 

New System Combining 
Other Functions 

Assemblies 

Hybrid Coupler 
Directional Coupler 

RF Combiner 

Dimensions 

6.5” x 11.00" x 1.3" 
2.88" x 9.5” x 2.3" 

6.75" x 6.25" x 1.25" 

Volume (Total) 

92.95 = 62.93 = 155.88 in* 

52.73 in 3 

Weight (Total) 

2.0 + 1.28 = 3.28 lbs. 

3.75 lbs. 


As discussed in preceding paragraphs of this 
section the ERD can be used in place of the 
Distributor and the IRD. Tables 21 and 22 com- 
pare parameters of the existing IRD/Distributor 
with those of the ERD. The ERD is a single 
assembly designed to provide the same functions 
as those provided by the the IRD and Distributor 
in the existing system. Figure 57 is an ERD 
interface diagram. 


Using the ERD and the RF Combiner in the RSS 
will provide a savings in terms of the number of 
different assemblies, the total number of assem- 
blies, volume and weight. The number of unique 
assemblies decreases from 5 to 2. The total num- 
ber of assemblies is reduced from 14 to 9. The 
volume decreases by 3027 cubic inches. The 
weight is reduced by 76.5 pounds. The reduction 
of assemblies, volume and weight shown in Table 
23 parallels the reductions realized in the ARD. 


Table 21. External Tank Comparison 



Existing System 

New System Combining 
Other Functions 

Assemblies 

Distributor (1) 
IRD (1) ET 

ERD (2) 

Dimensions 

ET Distributor 
12.85" x 6.06" x 9.06" 
IRD 

4.0" x 7.41" x 4.52" 

ERD 

7.55" x 7.05" x 3.025" 

Volume (Total) 

706 + 134 = 840 in 3 

161 + 161 =322 in 3 

Weight (Total) 

21 + 5.5 = 26.5 lbs. 

6.75 + 6.75 = 13.5 lbs. 


Table 22. SRB Comparison 



Existing System 

New System Combining 
Other Functions 

Assemblies 

Distributor (1) 
IRD (2) 

ERD (2) 

Dimensions 

SRB Distributor 
18.09" x 6.97" x 9.15" 
IRD 

4.0" x 7.41" x 4.52" 

ERD 

7.55" x 7.05" x 3.025" 

Volume (Total) 

1154+ 134+ 134= 1422 in 3 

161 + 161 = 322 in 3 

Weight (Total) 

35 + 5.5 + 5.5 = 46 lbs. 

6.75 + 6.75 = 13.5 lbs. 
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Table 23. Overall RSS Comparison 



Existing System 

New System Combining 
Other Functions 

Assemblies 

5 Unique Assemblies 
14 Total Assemblies 

2 Unique Assemblies 
9 Total Assemblies 


ET Distributor (1) 

SRB Distributor (2) 
IRD (5) 

Directional Coupler (3) 
Hybrid Coupler (3) 

ERD (6) 

RF Combiner (3) 

Dimensions 

SRB Distributor 
18.09" x 6.97" x 9.15" 
ET Distributor 
12.85" x 6.06" x 9.06" 
IRD 

4.0" x 7.41" x 4.52" 
Hybrid Coupler 
6.5” x 11.00" x 1.3" 
Directional Coupler 
2.88" x 9.5" x 2.3" 

ERD 

7.55" x 7.05" x 3.025" 
RF Combiner 
6.75" x 6.25" x 1.25" 

Volume (Total) 

840 + 1422 + 1422 + 156 + 
156 + 156 = 4152 in 3 

322 + 322 + 322 + 53 + 
53 +53 = 1125 in 3 

Weight (Total) 

26.5 + 46 + 46 + 3.28 + 
3.28 + 3.28 = 128.34 lbs. 

13.5 + 13.5 + 13.5 + 
+3.75 + 3.75 + 3.75 
= 51.75 lbs. 


7.0 ONE-STEP CRYPTO SYSTEM 

An alternate technique called “one-step crypto” is 
recommended by Cincinnati Electronics. This 
technique provides the same benefits as an 
Encryption/Authentication system. These benefits 
include simplified ground checkout of the secure 
codes without concern for compromising security 
by transmitter radiation. By loading a 
“difference” code at the same time the secure 
codes are loaded for a specific mission, the secure 
codes are made to look like normal unclassified 
test codes but are fully exercised in the Flight 
Termination Receiver^FTR). In the FTR, the 
difference code is added to the secure code to 
make the FTR respond to the normal test codes. 
Switching to the secure codes is accomplished by 
transmitting a “switch-to- secure” command which 
is another unclassified test code that is transmitted 
only following load of the secure codes in the 


ground encoder. The switch-over causes the 
“difference” codes to be zeroed, requiring trans- 
mission of the secure codes to activate 
commands. Additional transmission of the 
“switch-to-secure” command causes the system to 
verify the switch-over action (zeroing of the 
“difference” codes) by transmitting a code over 
the normal pilot tone detection channel prior to 
vehicle launch. Once switch over is activated, the 
only way to return to unclassified test code opera- 
tion is to reload test codes in the FTR and ground 
encoder. This technique is equivalent in this 
application to the Encryption/Authentication 
system except only one command synchronization 
(called vehicle command count or VCC) change is 
used. Since the VCC switch is verified prior to 
launch, command count synchronization prob- 
lems are avoided. Note that once an Arm, Fire, 
or Other command is transmitted, security of that 
command is no longer important. 
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The advantage of the “one-step crypto” technique 
is that proper VCC synchronization can be 
verified prior to launch. Also, expensive crypto 
chips including their attendant size, weight and 
power requirements are not required in either the 
FTR or ground equipment. In addition, there is 
no reason to assign a security classification to the 
FTR. 

The one-step crypto system will be described by 
first explaining key aspects of the current high 
alphabet system and then showing how minimal 
modification can provide benefits similar to the 
crypto system. 

A system block diagram is shown in Figure 58. 

In the current system, high alphabet characters are 
FM modulated on the uplink carrier and detected 
in the launch vehicle FTR. The detection process 
uses A/D sampling of the receiver output followed 
by Fast Fourier Transform signal processing to 


determine each tone-pair character transmitted on 
the uplink. Following detection of an entire 
message, the uplink character sequence received 
is compared to character patterns stored in mem- 
ory to determine whether a match exists. If no 
match is found, the command is ignored. If a 
match is found, the command matched is 
executed. 

Tone pair characters are identified digitally by 
using one byte. The second least significant bit 
represents tone 1, the third least significant bit 
represents tone 2, etc to the most significant bit 
which represents tone 7. Each character therefore 
has two and only two “ones” and the least signifi- 
cant bit is always zero. Storage of an eleven 
character command requires eleven bytes plus 
additional bytes to store the command ID (such as 
Arm or Fire), fill bytes, and cyclic check code 
information used for verification of the initial code 
load process. Table 24 shows the stored com- 
mand format. 



Figure 58. High Alphabet FTR 
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Table 24. Command Format 


BYTE 


1 

00000000 

2 

Message Char, #1 

3 

Message Char, #2 

4 

Message Char, #3 

5 

Message Char, #4 

6 

Message Char, #5 

7 

Message Char, #6 

8 

Message Char, #7 

9 

Message Char, #8 

10 

Message Char, #9 

11 

Message Char, #10 

l2 

Message Char, #1 1 

li 

Command Identifier 

14 

oooooooO 

15 

00000060 

16 

Cyclic Check Code 


Preamble 


> 

> 

> 

> 

> 


MSG. n 

17 

T6 

T5 

T4 

T3 

T2 

T1 

0 

FORMAT 










> 

> 

> 

> 


ARM 

0 

1 

1 

“IT 

1 

0 

0 

1 

FIRE 

1 

6 

1 

0 

6 

1 

0 

1 

SPARE #1 1 

6 

1 

6 

1 

1 

6 

1 

0 

SPARE #2 

1 

0 

6 

1 

0 

1 

1 

0 

SPARE #3 

1 

1 

6 

6 

6 

0 

1 

1 


For single step crypto, eleven additional bytes are 
loaded into code memory (using a KYK-13 Fill 
device) along with each secure command code. 
Prior to comparison for identifying uplink com- 
mands, each of these bytes is added to its 
companion message character byte (see Table 25). 
This changes the code required for uplink match 
to any other code desired, such as a normal test 
code. To switch to the secure code, a command 
is transmitted that causes erasure (zeroing) of the 
added bytes. Additional transmissions of this 
command causes verification of the zeroing action 
to be signaled on the pilot tone output. 
Transformation of a secure code to a test code 
allows radiated transmission for testing. 
Switching to the secure code is verified prior to 
launch. 

With the “difference^codes cleared, no code 
translation takes place. Since operation of the 
FTR does not change in any way, addition of the 
zeroed difference codes yields the original secure 
codes that are now required for command execu- 
tion. 


Implementation of the One-Step Crypto does not 
significantly affect the Decoder hardware configu- 
ration. Minor software changes are needed. 
Similar changes are required in the Ground 
Encoder hardware. 


8.0 ORDNANCE INITIATION SYSTEMS 

Two types of ordnance initiation systems are 
addressed in this study, Laser Initiation Systems 
and Bridge Wire Systems. These systems are 
discussed in the subsequent paragraphs. 


8.1 Laser Initiated Systems 

These systems use laser light to ignite the initiator 
at the ordnance. Energy from a laser light source 
is passed through fiber optic cable via a dis- 
tributor to the initiator. An Arm/Safe device 
capable of interrupting the light to Safe the system 
is included in the path. 
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Table 25. Command Format For One-Step Crypto (Example) 


BYTE 

SPARE 1 code 

"Difference" code 

SPARE 1 code 

1 

00000000 


switched to SPARE 2 

2 

ilWITiTilEiW 



5 — 


01110110 | 


4 


i i i i oOOO | 

000 1 1000 

5 

HKI££II£I£HI 


0 1 100000 j 

6 

■msfisiKsxm 


00000 1 1 0 

7 


10001010 


8 


11011100 

■SlillilSUSUH 

— 5 — 

Ml I II Ilf 


■miimiw 

10 

1 1000000 

1 10000 10 

■MmimlHiHiHi 

11 


1110 1000 

BtilSlSWffilMi 

12 

■ II II 1 1 1 ■ 

110 1 1000 


i 13 




14 

00000000 



15 

■VlTlTlTlTlTlTlTOH 



16 

|||0|S| 1 fSN JT58 ®SP5!SM 




8.1.1 Laser Light Sources 

Two sources are presently used to generate laser 
light; the solid state laser rod and the laser diode. 
These sources are used to provide three types of 
laser systems which are presently under develop- 
ment . 

• Pyro Zirconium Pump (PZP)/solid state 
laser rod. 

• Reusable Flashlamp/solid state laser rod. 

• Laser Diode. 

The Pyro Zirconium Pump (PZP) system uses a 
solid state laser rod that is pumped by a non- 
reusable PZP. The PZP is a type of flashbulb that 
is flashed to promote lasing. The device is fired 
by a low voltage (28 VQfrom a simple trigger cir- 
cuit. A physical safing device is required between 
the laser source and the initiator. Output energy 
from the laser rod is around 4 joules depending 
on the number of PZP’s used. The initiator's all 
fire level can be as low as 10 millijoules. Since 
the output energy is so high, beam splitters can be 
used to guide the output of one laser rod to 
multiple initiators. 


The Reusable Flashlamp system uses a Xenon 
flash lamp to provide the energy required to pro- 
mote lasing. Flashlamps require a high voltage 
(1000V) to fire and a complicated trigger circuit to 
fire efficiently. Output energy is approximately 
100 - 200 millijoules. 

The Laser Diode is also reusable and has an out- 
put energy of 10 - 100 millijoules. This device is 
sensitive to temperature variations. Laser diodes 
require low voltage to fire and a complicated 
trigger circuit to fire efficiently. 


8.1.2 Distributor Systems 

Distributors are used to route the laser output to 
the desired initiator. Two types of Distributor 
systems are presently used. 

• Stepper Motor Distributor 

• Acousto-optic Distributor. 

The Stepper Motor Distributor is an electro- 
mechanical device used to align the laser output to 
a particular fiber optic. The Acousto-optic 
Distributor uses an RF signal to create a standing 
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wave in a crystal which in turn produces a defrac- 
tion grating. This defraction grating can deflect 
up to 90% of the laser light through angles up to 7 
degrees. 


8.1.3 Safing Devices 

Physical safing devices include the Solenoid 
Driven Shutter and the Manual Safing Barrier. 
The Solenoid Driven Shutter blocks the path of 
the laser light in the Safe state. Issuing the Arm 
signal removes the barrier from the laser path. 
The Manual Safing Barrier is similar to the 
Solenoid Driven Shutter, with the addition of a 
manual handle. With the manual safing barrier, 
the system can be manually safed, but not manu- 
ally armed. 


8.1.4 Laser Initiators 

Since the laser system delivers a different type of 
energy than the conventional systems, modifi- 
cations to the NASA Standard Initiator (NSI) are 
necessary. 


8.2 Bridge Wire Systems 

The most widely used and best characterized 
ordnance initiation systems are the Electro- 
Explosive Devices (EEDs). 

• Hot Bridgewire (HBW), low voltage type. 

• Exploding Bridgewire (EBW), high voltage 
type. 

• Exploding Foil Initiator (EFI), high voltage 
type. 

The first of these, the (HBW) is a low voltage 
device using a mature^ technology. The present 
RSS initiators use this type device. 

The remaining two, (EBW) and (EFI), are newer 
devices using high voltage. High voltage systems 
were developed to further reduce the probability 
of inadvertent initiation. High voltage systems 
allow the use of an all electronic Safe/Arm device. 
If electronic Safe/Arm is used, the initiator must 


not be fired by signals of less than 500 V. MIL- 
STD-1316D addresses the use of solid state 
electronics for fuze safety design. High voltage 
devices have the disadvantage of being intolerant 
to high shock, vibration, or high temperatures. 

Each of the three initiator devices are discussed in 
the subsequent paragraphs. 

8.2.1 Hot Bridgewire (HBW) Initiator 

The HBW is a low voltage system. A thin metal- 
lic film bridge and a semiconductor bridge 
consisting of heavily doped silicon are two types 
of hot wire initiator. The primary explosive is 
placed next to the bridgewire. The HBW uses 
shielded wires to carry current to the initiator. 
Range safety requirements for this system are 3.5 
amps "all fire" and a "no fire" current of 1 amp 
for at least 5 minutes. Because the primary 
explosive may be subject to inadvertent initiation, 
a manual Safe/Arm device is required for this low 
voltage system. 


8.2.2 Exploding Bridgewire Initiator 

The first of the two high voltage devices is the 
exploding bridgewire. A bridgewire is placed 
into direct contact with a moderately sensitive 
explosive. A high current pulse must be sent 
through the bridgewire to deposit energy fast 
enough to convert it to plasma. This high current 
causes the bridgewire to swell so rapidly that it 
creates a shock front which initiates an insensitive 
secondary explosive. The moderately sensitive 
explosive must be sensitive enough to respond to 
the plasma created by the exploding bridge. 


8.2.3 Exploding Foil Initiator 

The second high voltage EED is the exploding foil 
initiator. The EFI’s exploding foil element is a 
thin neck of foil mounted on stripline conductors. 
A thin plastic flyer is mounted to the stripline 
conductors. A barrel separates the plastic flyer 
from the explosive material. Thus, an air gap 
exists between the flyer and the explosive 
material. This way, the foil element does not 
touch the explosive material in standby. When 
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high current is sent through the stripline, it 
vaporizes the foil which sends the flyer across the 
air gap to slap the explosive material. Once the 
explosive is slapped, there is enough kinetic 
energy transferred to detonate the secondary 
explosive. 

9.0 ELIMINATION OF OUTSTANDING 
SYSTEM WAIVERS 

Several Waivers to the requirements of Range 
Safety Manual, Vol. I, Safety Air Force Eastern 
Test Range Manual (AFETRM- 127-1) have been 
granted as the result of application of the present 
secure system. These Waivers are categorized as 
follows: 

CD Those required to use existing 
Satum/Opollo equipment for the inher- 
ent £Ost advantage. 


CR Those generated to improve CR ew 
safety. 

SC Those generated as a result of Shuttle 
Design Configuration. 

S E Those required for SEcuritv. 

Some of the added functions provided for the 
ERD described in paragraph 6 allow waiver 
elimination. The outstanding waivers are sum- 
marized in Table 26. This table provides a listing 
of the waivers sorted by category (Type). Also 
provided is the specification paragraph number, 
the Context of the requirement, and a Remarks 
column. Comments in the Remarks column pro- 
vide a brief indication of why the waiver is 
needed. The waivers that are affected by the new 
design are discussed in notes referenced in the 
Remarks column. 


Table 26. Outstanding System Waivers 


TaKaGKaFIT 

TYPE 



4. 3. 9. 3. 6 


Receiving 60 dB Bandwidth of ±180 
kHz 

Note 1 

4.3.9.3.1& 


Output Connectors; functionally 
separated 

Note 1 

3. 6.9.7. 1 



Existing Saturn system 
compatibility 

3. 6.9. 7. 7 



Existing Saturn system 
compatibility 



S&A Position Indication 

Existing Saturn system 
compatibility 

4.3.16.1 


S&A Verification of Design 
Requirements 

Existing Saturn system 
compatibility 

4. 4. 2. 4 


S&A Bench Test 

ETA procedure compatibility 

g 

cr6i 

Arm Command Engine Shutdown 

Shuttle Configuration 
compatibility 

E 



Note 2 

4.3.12.1 

mm 

1. No single point failure may render 
the system inoperative 

2. Batteries must be independent of 
other systems 

Shuttle Configuration 
compatibility 



ET S&A Indications - Boost 2 

Shuttle Configuration 
compatibility 

c 

mmm 

System Reliability Design 

Note 3 
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Table 26. Outstanding System Waivers - Continued 


■‘.EfOTtravaa 

■Kid 3 ■ 

■whirii h »;« 

REMARKS 

| 


Destruct Simulator 

Shuttle Configuration 
compatibility 



24 Hour Test 

Note 4 

1.2.5. 1-2 


Tracking Beacon 

Shuttle Configuration 
compatibility 


SE01 

Command Output Response Time 15 
ms 

Note 5 (WSMCR 127-1 j 

paragraph 4.7.2. 4.2.7) 

HHigj 

SE02 

IRIG Tones 1. 2. and 5 

Note 5 (WSMCR 127-1 

paragraph 4.7.2.4.2.7) 


■ 

Command Output Verses Tones 

Meets WSMCR 127-1 (Dec. ‘89) 
para. 4.7.2.4.2.3-6 except pulse 
instead of continuous outputs 


hh 

2 dB Decoder Bandwidth 

Note 5 (WSMCR 127-1 

paragraph 4.7.2.4.2.8) 



Receiver to Decoder Noise Margin 

Note 5 (WSMCR 127-1 

paragraph 4.7.2.4.2.9) 



Command Transition Time 

Not applicable to High Alphabet 
system 



IRD Signal Strength 

Not applicable to High Alphabet 
system 


Notes: 

1 . Waiver no longer needed. IRD meets this requirement as will updated versions. 

2. This waiver is eliminated if the Embedded Distributor is included in the IRD design. In this design 
the PIC is eliminated. 

3 . This requirement is presently violated by the use of a single IRD on the ET and the packaging of 
the redundant sections (A & B) of the Distributor in the same package. The use of an ERD with 
Embedded Cross-strapping separates the A & B distributor logic and packages each section in the 
associated ERD package. This approach requires the use of two ERD's on the External Tank. The 
space and cost reduction resulting from elimination of the Distributor should make the use of two 
ERDs on the ET practical. 

4. Use of the One-Step Crypto option eliminates the need for closed loop testing. 

5 . It is CE’s understanding that the document currently controlling range requirements, ESMCR 127- 
1, is being rewritten. We also understand that after rewrite, chapter 4 will be identical to that in 
WSMCR 127-1 dated 15 December 1989 which has been updated to include the Secure High 
Alphabet system: After this ESMCR 127-1 rewrite occurs, this waiver will not be necessary. 
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10.0 CONCLUSIONS 

During this study, the present Space Shuttle 
Range Safety System was investigated to provide 
MSFC with information and recommendations 
regarding needed technological updating. 

Experience manufacturing the Integrated 
Receiver/Decoder (IRD) was reviewed to deter- 
mine where improvements in the design could 
benefit producibility. Hardware recommenda- 
tions for updating the IRD include: 

• Elimination of obsolete and near obsolete 
parts. 

• Reliability improvement (IRD parts count 
reduced from 744 to 465). 

• Performance improvements. 

• Producibility improvements (cost reduc- 
tion). 

System recommendations include changes to 
simplify the system configuration. Further inte- 
gration of functions in a single housing can 
provide a total system weight reduction of 
76 pounds. 

Operational recommendations include a “Test” 
command that will cause the unit to execute a 
comprehensive Self-Test routine including a fail- 
safe redundancy check. Self-Test results are 
reported over the pilot tone TLM line. Also 
recommended is a software technique that will 
simplify final secure command checkout by 
allowing open transmitter command radiation 
without sacrificing security. 

Several of the technical performance improve- 
ments and hardware reductions resulting from this 
study are highlighted below and summarized in 
Table 27. ^ 

• Complete output redundancy check added to 
Self-Test. 


• Hi-alphabet RF Self-Test command added 
with results transmitted over the pilot tone 
TLM link. 

• Precision signal strength telemetry added. 

• RF bandwidth reduced from 3 MHz to 0.8 
MHz. 

• Time windows added to first and second 
half of output commands. 

• Sensitivity improved from -110 dBm 
(typical) to -1 13 dBm (typical). 

• Optional one-step crypto technique added. 

• Component count reduced from 744 to 465. 

• Power drain reduced from 12 watts to less 
than 4 watts. 

• Weight reduced from 5 lbs. to less than 3 
lbs. 

• Volume reduced from 87 cu. in. to less than 
60 cu. in. 
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Table 27. Recommended Changes Summary 


Failures and Trends Analysis: 

Review of TDR’s, MRB actions, MRR’s, 
scrap, and test failures indicated that a promis- 
ing area for improvement was in tuning and 
alignment. 

PC board assembly is time consuming, princi- 
pally due to the TLC required in the soldering 
process. 

Obsolete components: 

SBP9989 microprocessor 
ER2051 EAROM 
91L24 RAM 

Other parts approaching obsolescence. 


Solution: 

A design using new components that reduce the 
required tuning elements from 13 to 1, and 
select components from 37 to 13. Overall 
improvement is 50 to 14. 

Use polyimide PC boards that are much more 
rugged for soldering. Use surface mount parts 
that require less board area and can be automat- 
ically placed and soldered. 

Solution: 

Use latest technology components that are 
class “S” , or Mil grade, screenable to the 
required reliability level. 

Redesign as prudent using latest technology 
circuits to improve performance and reduce 
size, weight, power drain, and cost. 


Performance Improvements: 

The SSTLM curve varies considerably from 
unit to unit and does not provide the accuracy 
desired by Range Safety personnel. 

Output redundancy is not checkable once the 
unit is fully assembled. 


RF input circuit bandwidth is about 3 MHz 
wide. The cavity resonators used in this circuit 
involve a difficult soldering operation involving 
soldering to the plated aluminum case. 


Four-pole anti-alias filter requires meticulous 
tuning and four coil/capacitor matched-sets. 


Solution: 

Update the design to include “precision” 
SSTLM as used in later model FTR’s. Using 
microprocessor correction, This saves over 40 
parts including several which are selected. 

Add an output redundancy check to the 
Self-Test. Provide for Self-Test actuation and 
verification by RF link and Pilot Tone TLM 
respectively. 

Use SAW resonator filters for front-end selec- 
tivity. These very small devices reduce the RF 
bandwidth to about 500 kHz and have four 
leads similar to a transistor for soldering 
directly to the PC board. As a result of a pre- 
liminary investigation for this study, it is 
believed that lightning protection will be equal 
to that of the cavity resonators. 

Use an active filter. Although this requires 
more parts, no tuning or matching is required, 
reliability is significantly improved, and selec- 
tivity is better. The difference in board area 
required is not significant since surface mount 
components are used for the R’s and C’s. 
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Table 27. Recommended Changes Summary - Continued 


Operational Interface Improvement: 

During prelaunch checkout, special procedures 
and hardware are required to avoid RF radiation 
of secure codes. 


System Improvements: 

The present hybrid coupler and directional 
coupler are much larger than required relative to 
the current state of the art 


The total RSS weight not including the Safe 
and Arm device (14 assemblies) is 128 lbs. 


Solution: 

Implement a “one-step crypto” technique. The 
umbilical coax and directional coupler can be 
eliminated. 


Solution: 

A much smaller unit developed by CE for 
MSFC can replace this item. Alternately, a 
“one-half’ hybrid coupler could be added inter- 
nally to each IRD. 

By combining functions, total assemblies can 
be reduced to 9, and total weight reduced to 52 
lbs. 

Weight savings: 76 lbs 
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APPENDIX A 

IRD AND ARD RELIABILITY PREDICTION DATA 


This Appendix contains tables of data used for the reliability prediction of the IRD and ARD units. Tables 
A-l and A-2 contain IRD and ARD data respectively. Failure Rates are in failures per million hours. 
Mean Time Between Failures (MTBF) is in hours. The Environment of use is Missile Launch (ML) per 
MIL-STD-217E. 


A-l 
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Table A-l. IRD Reliability Prediction Data 
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Table A-l. IRD Reliability Prediction Data - Continued 
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Table A-l. IRD Reliability Prediction Data • Continued 
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Table A-l. IRD Reliability Prediction Data - Continued 
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Table A-J. IRD Reliability Prediction Data - Continued 
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Table A-l. IRD Reliability Prediction Data - Continued 
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Table A-2. ARD Reliability Prediction Data 
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Table A-2. ARD Reliability Prediction Data - Continued 
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Table A-2. ARD Reliability Prediction Data - Continued 
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Table A-2. ARD Reliability Prediction Data - Continued 



IZ3 


CINCINNATI | 
KLMCTRONIC8 ! 





















